หน้าเว็บ

วันจันทร์ที่ 16 พฤษภาคม พ.ศ. 2559

TU CTF 2016: Student Grades (Web) Write-up


Descriptions:
We are trying to find out what our grade was, but we don't seem to be in the database...
Can you help us out?
http://104.199.151.39/index.html
Solution: 

1. "in the database..." on description make me sure, It about SQL Injection.

2. Index page have a input of name that want to show grade.


3. View source in index.html and get some script.


4. In line 46 is vulnerable to SQL Injection but in line 50 means the data will send with md5 to postQuery.php by ajax.


5. In Response tab, I found some comment that tell me a SQL query statement.


6. Write a python script to get data in each step, Found Database: tuctf, Tables: tuctf_grades, tuctf_info, tuctf_junk Columns: item, value and Flag store in tuctf_info.



7. select value from tuctf_info


Python Script:


Flag: TUCTF{v4ccinate_y0ur_databa5e5}

1 ความคิดเห็น:

  1. I was very happy to find this site. I really enjoyed reading this article today and think it might be one of the best articles I have read so far. I wanted to thank you for this excellent reading !! I really enjoy every part and have bookmarked you to see the new things you post. Well done for this excellent article. Please keep this work of the same quality.
    Data Science Course in Bangalore

    ตอบกลับลบ