Hackover CTF 2018: who knows john dows?=======================================
## Description
Howdy mate! Just login and hand out the flag, aye! You can find on [h18johndoe](https://github.com/h18johndoe/user_repository/blob/master/user_repo.rb) has allyou need!
http://yo-know-john-dow.ctf.hackover.de:4567/login
alternative: http://46.101.157.142:4567/login
## Solution
[The first link](https://github.com/h18johndoe/user_repository/blob/master/user_repo.rb)points to a Ruby script in a GitHub repository that seems to handle loginsfor the challenge website. The script is vulnerable to SQL injection.
```rbdef login(identification, password)    hashed_input_password = hash(password)    query = "select id, phone, email from users where email = '#{identification}' and password_digest = '#{hashed_input_password}' limit 1"    puts "SQL executing: '#{query}'"    @database[query].first if user_exists?(identification)end
def hash(password)    password.reverseend```
However the challenge website first asks us to provide a valid username or e-mailand SQL injection doesn't work here. It seems that we need to find a validusername or email somewhere.
Since the script is stored in a git repository we decided to have a look at thecommit history.
```$ git shortlog -sne     1  John Doe <[email protected]>     1  John Doe <[email protected]>     1  John Doe <[email protected]>     1  John Doe <[email protected]>```
`[email protected]` is a valid e-mail for the challenge site. After enteringthat we're directed to a password field which is vulnerable to SQLi.
By using `1' = '1' RO '` as our password (reversed because `hash()` reverses thepassword) we can get the flag.
Flag: `hackover18{I_KN0W_H4W_70_STALK_2018}`