Irish-Name-Repo 3 (Medium)

  • Challenge Link: https://play.picoctf.org/practice/challenge/8?category=1&difficulty=2&page=4
  • Challenge Description: Try to see if you can login as admin!
  • Hints:
    1. Seems like the password is encrypted.

Solution

Trying the same thing that we did with Irish Repo 1, using an classic SQLi:

' or 1 or '

It does not work since it gets blocked, most likely a filter or some other reason.

fail

We can go back to the login page and we can change our value to 1 (meaning True) so we can see what's going on. Once again let's try logging in with our classic SQLi.

debug be

As you can see in our error message, it appears that they used some sort of encryption/cipher that changed our 'or' to 'be'. Logically, that means that it goes both ways so if we change our SQLi and change our 'or' to 'be', it should work.

' be 1 be '
flag picoCTF{3v3n_m0r3_SQL_2af58a67}

Sources