PWN COLLGE Web Hacking
Web hacking dojo walkthrough pwn.college
Level 1
First run the challenge from /challenge
Now try path traversal with path argument
Level 2
Exploit a command injection vulnerability
Start the challenge
the semicolon at the end ensures that the shell knows the command sequence is complete.
Level 3
Exploit an authentication bypass vulnerability
Level 4
Exploit a structured query language injection vulnerability to login
Doing it with python
Level 5
Exploit a structured query language injection vulnerability to leak data
Code Breakdown
Fetching the Query Parameter:
This line retrieves a
query
parameter from the URL's query string. Ifquery
is not provided, it defaults to%
, which is a wildcard in SQL'sLIKE
clause.Executing the SQL Query:
This line constructs a SQL query using the
query
parameter. Since it directly inserts thequery
parameter into the SQL statement, it is vulnerable to SQL injection.Returning the Results:
This line formats and returns the results of the query, joining all usernames with newline characters.
Exploiting SQL Injection
To exploit the SQL injection vulnerability, you can manipulate the query
parameter to include SQL commands that alter the behavior of the query. Here's how you can do it:
Leak All Usernames:
By using the
%
wildcard in theLIKE
clause, you can match all usernames:URL:
This constructs the following SQL query:
Since
%
matches any string, this will return all usernames in theusers
table.
and then we can append Union to dump all passwords
Level 6
Exploit a structured query language injection vulnerability with an unknown database structure.
Table Creation:
The code first creates a table with a name based on a hash of the
flag
. The hash ensures the table name is unique and difficult to guess.The table contains a single row with
"flag"
as the username and the actual flag value as the password.
Query Parameter Handling:
The
query
parameter is retrieved from the URL's query string. Ifquery
is not provided, it defaults to%
, which is a wildcard in SQL'sLIKE
clause.
SQL Query Execution:
This line constructs and executes a SQL query to select usernames from the dynamically named table where the username matches the
query
parameter.
Returning the Results:
The code joins all the retrieved usernames with newline characters and returns them as a response.
Last updated