Write Up Sysdream Challenge [Auth Bypass - Sqli]
Sysdream is a French infosec company who’s organizing recruitment evenings. In order to be invited, you have to solve a little challenge.
Let’s try some inputs.
Bad creds. Let’s try some other common creds
An other error message. What in my last two request has change to trigger this “bad char” message? The password “password”, let’s try with substrings of “password” to find what char is forbidden: We try to delete the last char:
Same error, let’s continue with “passwo”:
Bad creds, so it seems that the R letter is forbidden? Let’s try:
Nope! It must be a substring with the R letter: OR! Now we have an idea of what to do on this chall : SQLi but it seems that there’s some forbidden words.
The most common sqli to bypass auth forms can now be tried: admin’ –
POST username=admin' --&password=anything
There’s forbidden chars in this request. By using the same method, we find that the comment char - is not allowed. So how can we bypass this? Let’s try other SQL comments :
/* This is a sql comment */
POST username=admin' /*&password=anything
Cool, a new error message! This means that we are not using invalid chars but it seems to have an error in our SQL syntax. Let’s assume that the SQL query should be something like:
SELECT * FROM users WHERE username='admin' AND password='admin'
What we injected in our last attempt, made this SQL request looks like:
SELECT * FROM users WHERE username='admin' /*' AND password='anything'
This is not a correct syntax because this comment method needs a start and an end. So we’ll use the password variable to close it!
POST username=admin' /*&password=*/'
This makes our SQL query looks like:
SELECT * FROM users WHERE username='admin' /*' AND password='*/''
Which comments the password criteria in the query. And with that, we bypassed the auth form: