[CTF] WU - Access Granted

Difficulty Level : Very Easy

Challenge Category : Web

Description :

An employee website was designed, but it seems that security was not a priority. Will you be able to access the hidden section reserved for administrators? Maybe a simple mistake will get you there...
The flag address is well-guarded, but once you're logged in, everything will become clear.

Solution Steps

Step 1: Analyze the Web Application

1. Visit the Login Page:

   • Access the provided web application URL: http://<IP>:<PORT>/login.
   • The login page contains fields for username and password.

2. Test the Input Fields:

   • Try entering random credentials (e.g., username: test and password: test).
   • Observe that invalid credentials return an "Invalid login!" message.

Step 2: Test for SQL Injection

Based on the challenge description, the login functionality is likely vulnerable to SQL Injection (SQLi).

Crafting a Payload:

To bypass authentication:

• Use the following username:

  ' OR '1'='1
  

• Leave the password field blank.

Explanation:

• The payload ' OR '1'='1 closes the SQL query's string and appends an always-true condition.
• This tricks the application into validating the login without checking the actual credentials.

Step 3: Execute the Payload

1. Input the following credentials into the login form:

   • Username: ' OR '1'='1
   • Password: (leave blank)

2. Submit the form.

Expected Result:

• The SQLi bypasses authentication and logs you in as an administrator.

Step 4: Access the Admin Panel

After successful login:

1. Navigate to the admin panel at:

   http://<IP>:<PORT>/admin
   

2. The admin panel displays the flag:

   FLAG{s1mpl3_sq1_1nj3ct10n_fl4g}