Skip to main content

Lust - Kinnaird CTF

By

CTF Writeup: LUST Fragment (SQL Injection & WAF Bypass)

This challenge was a solid demonstration of how blacklist-based WAFs fail under pressure. What initially appeared to be a straightforward login bypass quickly evolved into a nuanced exercise in SQLite-specific SQL injection under extreme filtering.

1. Initial Reconnaissance

The application exposed two authentication endpoints:

  • index.php – standard username/password login

  • facebook_login.php – OAuth-style login integration

Basic testing (and source inspection) revealed that user-controlled input was directly concatenated into SQL queries—a textbook SQL injection vulnerability.

However, exploitation wasn’t trivial. The application was protected by an unusually aggressive Web Application Firewall (WAF) that blocked most conventional payloads outright.

2. Understanding the WAF Constraints

This wasn’t a simple ' OR 1=1 -- situation. The WAF employed regex-based filtering that aggressively blocked:

  • Core SQL keywords:
    SELECT, UNION, INSERT, DROP, FROM, WHERE, GROUP BY

  • Common SQL functions:
    hex(), load_extension(), and many others

The objective was not merely to bypass authentication, but to extract data from non-obvious tables—specifically one containing the real flag.

3. Bypass Strategy

When dealing with restrictive WAFs, the solution often lies in database engine quirks, not brute force. Since the backend was SQLite, the attack focused on edge cases the filters failed to anticipate.

The approach revolved around three core techniques:

  1. Case Manipulation
    Some WAF regexes fail to normalize case properly (e.g., sElEcT vs SELECT).

  2. Inline Comment Injection
    Breaking keywords using comments such as /**/:

    SEL/**/ECT
FR/**/OM

    This often defeats naïve pattern matching.

  3. Encoding & Literal Abuse
    Representing sensitive characters using encodings (HTML entities, numeric literals, etc.) to avoid keyword detection entirely.

4. Finding the Real Flag

The file fake.php was intentionally misleading and contained decoy data. A subtle hint in the README suggested the real flag lived elsewhere—specifically in a table named fragments.

Direct queries like:

SELECT * FROM fragments

were immediately blocked. The breakthrough came from recognizing that:

  • SQLite tolerates unusual syntax combinations

  • The stored flag fragment itself was encoded using HTML entities, preventing trivial string detection by server-side filters

This meant the WAF wasn’t just filtering input—it was also relying on encoded storage to obscure the output.

5. Extracting and Decoding the Flag

Using obfuscated SQLite-compatible syntax and encoding tricks, the following string was successfully leaked:

SkelerCTF{
LUST_FRAGMENT
_XXXXXXXXXXXX}

Decoding Process

Each HTML entity corresponds to an ASCII character:

EntityCharEntityChar
SSLL
kkUU
eeSS
llTT

Decoding the full sequence yields:

SkelerCTF{LUST_FRAGMENT_XXXXXXXXXXXX}

Key Takeaways

  • WAFs are not a substitute for secure queries
    Blacklist-based filtering is brittle and almost always bypassable when SQL injection exists.

  • Database-specific knowledge is a force multiplier
    Understanding SQLite’s parsing behavior and quirks was essential to bypassing the filters.

  • CTF challenges reward skepticism
    Fake flags and decoy files are common—always look for what’s not immediately visible.

Labels:

Comments

Post a Comment

Popular posts from this blog

DVWA CHEAT SHEET

By
“If you’re waiting for permission to break the system, you’re already too late.” What You’re Actually Dealing With DVWA isn’t random vulnerable code. It’s a deliberately broken system designed to teach how real applications fail — SQL injection, XSS, command execution, file inclusion, all of it ( edgenexus.io ) Multiple difficulty levels exist for one reason: To show you how weak defenses evolve into real ones. 0. Core Principle You don’t memorize payloads. You understand flow. Input → Application Logic → Output If you control input, you control logic. If you control logic, the rest is just execution. 1. SQL Injection “You don’t bypass authentication. You redefine it.” Break the query ' Error means the application is exposing its internal structure. Take control ' OR '1'='1 # You’re not logging in. You’re forcing the query to return true. Map columns ' ORDER BY 1-- ' ORDER BY 2-- You’re learning how the database thinks. Extract data ' UNION SELECT datab...
Post a Comment
Read more

Greed - Kinnaird CTF

By
Greed Challenge — RSA Low-Exponent Write-Up Overview This challenge revolves around a classic RSA weakness: using a small public exponent (e = 3) without proper padding . Under the right conditions, this allows direct recovery of the plaintext by taking an integer cube root of the ciphertext. The task is to identify the real encrypted flag among several decoys and exploit this mathematical flaw. Key Observations RSA Parameters Public exponent: e = 3 (Narratively hinted as the warden’s “three kingdoms”) Modulus size: ~254 bits Candidate ciphertext: 0x1aadb93ce9a5704a83345e00 Critical Hint “Sometimes the treasure is so light that it never touches the vault walls.” This implies the plaintext m is small enough that: m³ < N When this happens, RSA encryption becomes: c = m³ instead of: c = m³ mod N No modular reduction occurs — which is exactly what enables the attack. Cryptographic Background RSA encryption is defined as: c = m^e mod N If m^e < N , then: c = m^e For e = 3 , recove...
Post a Comment
Read more

Pride - Kinnaird CTF

By
Writeup: Pride Challenge (Reverse Engineering) Challenge Overview Pride is a multi-layered Windows reverse engineering challenge. It requires the researcher to navigate through a protective "shell" ( UPX ), bypass environmental checks ( Anti-Debugging/Anti-VM ), and eventually reverse-engineer a custom Virtual Machine (VM) architecture to extract the hidden flag fragment. 1. Initial Analysis & Unpacking The binary initially presents a decoy flag. Analysis with PEiD or Detect It Easy (DIE) reveals the executable is compressed with UPX . Manual Unpacking While a standard upx -d pride.exe is the first step, this challenge utilizes a modified UPX header . To unpack manually: Load the binary in x64dbg . Look for the POPAD instruction followed by a large JMP —this is the jump to the Original Entry Point (OEP) . Use Scylla to dump the process and fix the IAT ( Import Address Table ). 2. Anti-Analysis Bypassing Once unpacked, the binary performs several checks to ensure it...
Post a Comment
Read more