Official 0xBOverchunked Discussion

HTB Content Challenges
, , ,
23

hint please

24

hint pls

25

(Contains what could be construed as hints or spoilers.)

.
.
.

I read the code.
I found the endpoint vulnerable to SQL injection.
I found the right combination of sqlmap options. This worked in under 1 second on the local docker instance and took about 10 minutes against the live system.
I got the flag and submitted it.

I can’t help but think there is a more elegant way to solve this, which involves subverting the blind-but-vulnerable endpoint to manipulate the database, then using the useful but non-vulnerable endpoint to retrieve the modified entry. Or am I just overthinking it?

26

Guys really struggling with SQLMap. Tried multiple SQLMap flags, still no success. This is difficult or I m stuck in a rabbit hole. Can someone help please as my head scratching has been going on for 3 weeks now.

27

I am just repeatedly getting “All tested parameters do not appear to be injectable”

28

Guys really struggling with SQLMap. Tried multiple SQLMap flags, still no success.

What flags have you tried?

30

HTB{f4k3_fl4_f0r_t35t1ng}

31

I was using this flag to better understand what was sqlmap doing.
(-r req.txt --proxy=http://127.0.0.1:8080)
I don’t know why but burpsuite modifies headers and so injection was not possible.
Removed proxy flag and worked just fine.