circusmonkey404's Security Site

picoCTF2018 – Web – Irish Name Repo Objective : There is a website running at http://2018shell.picoctf.com:52012 (link [1] ). Do you think you can log us in? Try to see if you can login! Solution: So here is the thing Found the login page http://2018shell.picoctf.com:52012/login.html in inspector I see a value named Debug set to 0 I changed it to 1 and input a username/password Look at that the debug shows the SQL statement that ran when I hit login username: user password: user SQL query: SELECT * FROM users WHERE name='user' AND password='user' Login failed. So let’s write a little sql injection to pass the second part of the condition We want to modify the condition after the end to include an OR statement so that we can pass the authentication. So for user name I put in admin And for password I did    *'or'1'='1 Which made the sql statement    SQL query: SELECT * FROM users WHERE name='admin