Try all other injection operators to see if any of them is not blacklisted. Which of (new-line, &, |) is not blacklisted by the web application

HTB Content Academy
1

how should answer be written

1 Like
2

This threw me off too.
First to get the result you want in burp, only append the non url-encoded or url-encoded injectable character, without spaces or anything, in repeater.
Once you find out which character it is, try every possible operator and character names of it within the cheat sheet to submit as the answer.

3

How are you supposed to write the answer. I tried both encoded and non encoded.

4

i try all the operators and find 7 answers but none of them will accept as an answer could antone help me?
;
%3b
\n
%0a
&
%26
|
%7c
&&
%26%26
||
%7c%7c
``
%60%60
$()
%24%28%29
0x0a
Newline
`

5

Ya, its really annoying. Let e know if you figure it out.

6

I found it.

7

what is it?

9

This is an incorrect checking of answer. 2 hours out of my life. Correct answer is “New-Line” UpperCase with “-” delimiter…

1 Like
10

This question wanted us to use the URL-encoded character which was not highlighted in the question. For me the “&” worked which made things annoying.

4 Likes
11

For me $() and " ``" worked. But the answer was not accepting it. Finally, I inserted “New-Line” which was accepted as an answer… Don’t know how is this an answer, as “\n” does not work even when url-encoded.

1 Like
13

Using & worked and n\ doesnt work in burp, ¯_(ツ)_/¯
Maybe is just a bug, quite annoying.

15

i tried everything but it does not seem to work :c

16

IDK how you guys do it but i used

127.0.0.1%0a

and

127.0.0.1&

(this two worked for me so i tried both. Got it correct but how idk. as there are two answers)

17

I have the same question that’s crazy “&” works and is not a valid answer :sob: