Clicking on the hamburger menu, I found an interesting page for the admin login:
MenuAdmin Login
Here, I immediately thought of an SQL Injection, since inspecting the page source didn’t reveal anything interesting. Let’s move on to the exploitation phase.
PS: By the time I reached the third challenge in this series, I discovered there is a parameter in the form debug=0, which, when set to 1, shows the query… So always remember to inspect the page source.
🔬 Vulnerability Analysis
Potential Vulnerabilities
SQL Injection
🎯 Solution Path
Exploitation Steps
Initial setup
We have an admin username, which we found on the Support page from the menu seen earlier:
Support Page
We can use this for a potential injection. Let’s move on to the exploitation phase.
Exploitation
The information gathered (about the admin user) turned out to be pretty useless, as it was a very simple SQL Injection. By entering the following in the username field:
1
' OR 1=1 --
I gained access and consequently obtained the flag.
Flag capture
Manual Flag
🛠️ Exploitation Process
Approach
The automatic exploit sends a simple POST request with the payload username=' OR 1=1 -- and password=, then, once access is granted, it extracts the flag from the response using a regex.
