---
# System prepended metadata

title: Zixem walkthrough SQL injection
tags: [sqli]

---

I am gonna do some SQLi challenges for my homework 😁 And gonna do this write-up to review or share with anyone who want to read it.Here the link of website : 
[Zixem](https://zixem.altervista.org/)

My task is is to select only the version & user and to take screenshot as proof.

So having fun.

# Level 1 (Super easy or not :) ) 

I think we should know that where is the SQL error. Let assume how the page is working.

``` color 
SELECT * FROM ANYTHING WHERE ID = 1 

```
Firstly the query can be easily broken by adding a single quote after the integer or adding(AND 1=2)
![ảnh](https://hackmd.io/_uploads/rJttEXry1x.png)

Things we need to do know is find the column and it can be done by many ways.

1. Order by
2. Union select
3. Group by

Start with order by 
![ảnh](https://hackmd.io/_uploads/Hye9LQH1kl.png)
When i try `order by 4` i got an error stating `unknown col 4`, so i guess that database has 3 columns.

Let's try with Group by : 
![ảnh](https://hackmd.io/_uploads/rJ1enrBykg.png)
Thus, the database has 3 cols. 

We have to add `AND 1=2` after the id to make the query invalid. All we need to do now is select `user()` and `version()`

So implement the query : 
``` color
Select * from anything where ID = 1 AND 1 = 2 UNION ALL SELECT user(),version(), 3 --
```
and i got the user and version 
![ảnh](https://hackmd.io/_uploads/rkC4f8H11x.png)

# Level 2 (Easy)
First, like the level 1, put an single quote after the number 
![ảnh](https://hackmd.io/_uploads/HJuLQUrJ1x.png)
Second, go looking for the cols. 
![ảnh](https://hackmd.io/_uploads/ByAkNIHkyx.png)
I got nothing here when trying to use UNION ALL. Just like the id is string now, not integer anymore. 
![ảnh](https://hackmd.io/_uploads/B1kNNLSy1e.png)
I just broke the query but it's said that i need to closed the quotation mark. 
![ảnh](https://hackmd.io/_uploads/rkO2EIHJkl.png)
And just like here i got another error. Let try with 4 cols.
![ảnh](https://hackmd.io/_uploads/SyjJr8H1kl.png)
I got it, so all i need to do now is find the version and user. 
``` color
SELECT * FROM profiles WHERE SHOWPROFILE=4 AND 4=5' UNION ALL SELECT 1,user(),version() ,4' —
```
![ảnh](https://hackmd.io/_uploads/HyNl9Lrykg.png)
# Level 3 (Medium) 

Like the level 1 and 2, we check that : 
![ảnh](https://hackmd.io/_uploads/HJ9Xp8BkJg.png)
But the on is filtered out
![ảnh](https://hackmd.io/_uploads/ByjJ0LHyyg.png)
So we gonna do with this 
![ảnh](https://hackmd.io/_uploads/ryClA8S1kg.png)
and just bypass it. So we gonna find user and version. 
![ảnh](https://hackmd.io/_uploads/S1nEC8BJyl.png)
Done with level 3.

# Level 4 (Normal)
Do same thing withs like the above level.
![ảnh](https://hackmd.io/_uploads/B1kveDry1l.png)
adding 5 : 
![ảnh](https://hackmd.io/_uploads/rJEf-DHyJg.png)
and just find the version and user 

![ảnh](https://hackmd.io/_uploads/HJlENWDSyJe.png)


# Level 7 (Medium)

Let's continue with level 7 

When i test it like the levels above, don't see anything chang, so i try to check the code 
![ảnh](https://hackmd.io/_uploads/rkHrAPB1kl.png)
so here the value turn to error and all the values that show in page is default.
![ảnh](https://hackmd.io/_uploads/ryahCvr1Jg.png)
We see that the value turn to show the version when we implement the query 
![ảnh](https://hackmd.io/_uploads/BkoACPrJ1e.png)
![ảnh](https://hackmd.io/_uploads/SJEM1uB1Jx.png)
# Level 8 (Hard) 

Just try to implement like the above 
![ảnh](https://hackmd.io/_uploads/S1_tg_SkJl.png)

The result is hacking attemp. So something is filtered out. The issue here is the white-spaces 
We must think how to replace the white space.
Let try with `+`
![ảnh](https://hackmd.io/_uploads/BkfiduryJl.png)
Nothing changes
I dont know anything about Url encodings so much learning more :< 
Here the links : [URL encoding](https://www.w3schools.com/tags/ref_urlencode.asp?source=post_page-----fb1830da2dba--------------------------------)
![ảnh](https://hackmd.io/_uploads/SJ1k6drkkx.png)
finally got this 
![ảnh](https://hackmd.io/_uploads/rJ-uZqS1ye.png)
The string "SELECT" has been filtered out so i must try "SELECSELECTT" 
![ảnh](https://hackmd.io/_uploads/rJ3cmcSJkx.png)
![ảnh](https://hackmd.io/_uploads/Skno79B11g.png)
So i finally got this ... 

# Level 9 (Medium)

![ảnh](https://hackmd.io/_uploads/ryqbPsr1kx.png)
Just do it like the level medium 

# Level 10 (Pro but i'm not)

In the url, i can find a string (that's a value of x). 
![ảnh](https://hackmd.io/_uploads/BJh187LJyl.png)

Decode it and i have : 
` !,0``` ` 
So weird, i have not seen it before. So lets googling.
After searching, i know the type of this is Uuencode.
![ảnh](https://hackmd.io/_uploads/Hyxytm81yg.png)

So *`!,0``* corresponds to 1
No we need to do the procedure 

1. Write the query
2. Encode it into Uuencode
3. Encode it into Base64
4. Submit the query

![ảnh](https://hackmd.io/_uploads/HyTV3QI1Jx.png)
![ảnh](https://hackmd.io/_uploads/B1eEI37I1kg.png)
![ảnh](https://hackmd.io/_uploads/r1KD2mUkJl.png)
We bypass it. So let show my name here and get version


