---
# System prepended metadata

title: Untitled

---



## Easy sql

### Abstract

This challenge is a stack sql injection challenge. SQL injection is the top 10 in OWASP. In recent years, many SQL injections challenges are created for CTFs and this one is a 
special SQL stack injection that is rarely seen. By solving this challenge, people can get the first hand of stack injection experience.


Note that this challenge has some flaws in the original CTF game 
```
`strstr` instead of `stristr`, it is not case sensitive
```
and this is my motivation to adapt this challenge.

### Description

#### Source code 

Easy sql is adapted from QWB CTF 2019. 
The source code is available in many websites:
1. https://github.com/glzjin/qwb_2019_supersqli
2. https://github.com/CTFTraining/qwb_2019_supersqli
3. https://zhuanlan.zhihu.com/p/78989602


This challenge is also adapted by many CTFs: 
1. https://buuoj.cn/challenges#[%E5%BC%BA%E7%BD%91%E6%9D%AF%202019]%E9%9A%8F%E4%BE%BF%E6%B3%A8
2. https://adworld.xctf.org.cn/task/answer?type=web&number=3&grade=1&id=5417&page=1
3. https://www.ichunqiu.com/game-gyctf


I use a docker image for that from a github repo.
(https://github.com/CTFTraining/qwb_2019_supersqli). 

I cite it in the source code:

![](https://i.imgur.com/xHuvwZA.png)

**Note that this challenge has very few code lines and the original challenge gives the key part. People can reproduce this challenge easily via the key filter. The code source of this challenge is not private**

#### Modification

We add two more filters for "set"/"prepare" commands. So our intended solution is only in "handler" command.

And you can see here is my modification git commit:
![](https://i.imgur.com/Oq3JZZA.png)

The indended solution for my challenge can also be found in my git commit:

![](https://i.imgur.com/TTB43zX.png)

#### Clarification

As for https://www.cnblogs.com/gaonuoqi/p/12398554.html mentioned, we have the same theory with the last solution but we have a different implementation and intended solution.

![](https://i.imgur.com/G4sTRmy.png)

You can see the filter order is different from easysql. And its intended solution:
```
GYCTF
1';
HANDLER FlagHere OPEN;
HANDLER FlagHere READ FIRST;
HANDLER FlagHere CLOSE;#
```
is also different from
```
DSO-NUS CTF
1'; handler `1919810931114514` open as hh; handler hh read first;#
```

And when we were creating this challenge, we were not aware of this blog.





## babyNote


### Abstract

babyNote includes two parts. The first part is about a flaw in source code. Players need to understand the given source code and then crack the user_id of admin. The second part is a SSRF challenge. SSRF is an increasing attack in server side.
https://owasp.org/www-community/attacks/Server_Side_Request_Forgery

Solving babyNote can help players gain the first-hand experience about exploiting SSRF.

### Description

#### source code

babynote is adapted from starctf 2021. The source code is available here. https://github.com/sixstars/starctf2021/tree/main/web-oh-my-note

We get permission to reuse and adapt from the source code holder.


#### modification

I add one more SSRF to that. I set up a filter that blocks all inner ip address. 

Here is the main part for SSRF:
![](https://i.imgur.com/fmp1Bhq.png)

And none of the existing solutions online can solve this challenge. Also we can see this challenge is not a widely solved one. 

Here is our intended solution which is available in git commit:
![](https://i.imgur.com/xlt5zOw.png)









