Inj3ction Time
100 points Hard

I stumbled upon this website: http://web.ctflearn.com/web8/ and I think they have the flag in their somewhere. UNION might be a helpful command

Flag
Rating 4.67
5
4
3
2
1

Discussion

did the flag changed?

0

Hello,

I have a doubt.

when given an id, it returns 3 text values (name,breed and color). When I try the payload (id=1+union+select+'a','b','c','d') why is it returning nothing.

because since when an id is given it is returning text values the result from the union operation should be text values or union query will fail.

but when I use the below payload it is working fine. id=1+union+select+1,2,3,4

the above query should cause error and should not give any results. But the app is returning 1,2,3 values on to the website.

What is happening here? Could anyone explain me?

Thanks

0

quick update:- inplace of 1 in id=1+union+select+1,2,3,4 I have used 'a'. SO the query now is

id=1+union+select+'a',2,3,4. <---- This is returning 0 results.

But when I use below query it is returning table names.

id=1+union+select+table_name,2,3,4 from information_schema.tables <---- returns table names

No idea why. Could someone please explain?

THanks

0

great challenge!

0

This was really quick but fun. The hint gave it away instantly for me

1

Hello,

I have a doubt.

when given an id, it returns 3 text values (name,breed and color). When I try the payload (id=1+union+select+'a','b','c','d') why is it returning nothing.

because since when an id is given it is returning text values the result from the union operation should be text values or union query will fail.

but when I use the below payload it is working fine. id=1+union+select+1,2,3,4

the above query should cause error and should not give any results. But the app is returning 1,2,3 values on to the website.

What is happening here? Could anyone explain me?

Thanks

inplace of 1 in id=1+union+select+1,2,3,4 I have used 'a'. SO the query now is

id=1+union+select+'a',2,3,4. <---- This is returning 0 results.

But when I use below query it is returning table names.

id=1+union+select+table_name,2,3,4 from information_schema.tables <---- returns table names

No idea why. Could someone please explain?

THanks

0

This was a really good challenge. I have been working on this once for a day and finally cracked it!

0

Found this very difficult, took me lots of research to solve. Site mentioned in comments was helpful. In the end got much better at understanding sql stuff and am ready to break the interweb.

0

Really good challenge. please do it yourself for learning something about SQLi !

1
Protected
0