LOS #1 gremlin write-up

---

What is LOS..?

LOS (Lord Of SQLInjection) is a web-hacking practice site where you can practice SQL Injection.

For SQL Injection, please read this post [Hacking/Web hacking] - SQL Injection ~heh.

Solution process

Since it's the very first one, to interpret it line by line — lines 14 aren't particularly needed, so interpreting from lines 56...

if(preg_match('/prob|_|\.|\(\)/i', $_GET[id])) exit("No Hack ~_~");
if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~");

Something we don't know, "preg_match", catches the eye — what is this?

What is preg_match?

In PHP, you write a regular expression using the preg_match function.

First argument: the regex pattern,

Second argument: the string to search,

Third argument: returns an array variable. It stores the matched values from the pattern match as an array.

What is a regular expression?

Please read [Hacking/Web hacking] - Regular expressions / commonly used regular expressions!

Because of this, when the user-entered id value contains 'prob', '', '.', or '\', a "No Hack ~~" screen appears.

And looking at the PHP above, you can see the input is received via GET. When received via GET, the input value is exposed directly in the parameter (URL).

$query = "select id from prob_gremlin where id='{$_GET[id]}' and pw='{$_GET[pw]}'";

Line 7 is a SQL statement we've seen a lot. It's a query that finds the values for the entered id and pw in the database and stores them in $query.

echo "<hr>query : <strong>{$query}</strong><hr><br>";

Line 8 plays the role of showing us that query!

$result = @mysqli_fetch_array(mysqli_query($db,$query));

Line 9 is a query that stores the entered $query value into $result as an array.

if($result['id']) solve("gremlin");

Line 10 seems to run solve("gremlin") if there's a value in $result ['id'].

Solution process

Looking at the text once more, it's a problem solved when $result ['id'] becomes true! The way to insert values is to write "? id=value&pw=value" at the end of the URL.

So shall we try SQL Injection as we learned earlier? Very varied answers come out per person, and whatever method you use, as long as it Clears, it's a correct method. Try it in various ways!

$query = "select id from prob_gremlin where id='{$_GET[id]}' and pw='{$_GET[pw]}'";

Looking at this query, if we input id=1234 pw=1234, it becomes select id from prob_gremlin where id='1234' and pw='1234'

it'll be entered like this. So if we write ' or 1=1 %23?

select id from prob_gremlin where id='' or 1=1 #' and pw=''

As above, id becomes true and this problem will be cleared.

What is %23?

How did the curry— I mean query statement output when you wrote %23?

It'll have shown up as # like this. This is called URL encoding.

What is URL encoding?

URL Encoding

1. A mechanism for converting characters or special characters into something universally accepted by web servers and browsers.
2. URLs can only be sent over the internet using the ASCII character set.
3. Since URLs often contain characters outside the ASCII set, URLs must be converted into a valid ASCII format.
4. URL encoding replaces unsafe ASCII characters with a "%" followed by two hexadecimal digits.
5. URLs cannot contain spaces. In URL encoding, spaces are generally replaced with (the + sign) or %20.

As above, %23 represents #. The reason for using # — as those who've read my SQL Injection blog will know — is to comment out everything after it.

You might ask, "isn't '--' a comment?" that's on my blog too — this uses MYSQL so the comment is #. -- works in Oracle and MSSQL.

And with this we've cleared stage 1, gremlin!!! Well done~

+Other solutions, tips

Simply making both the id and pw values true solves it.

1. id=' or '1'='1&pw=' or '1'='1
2. pw=' or 1=1%23
3. id=' or id='1' and pw='1' or 1=1%23

As above, several solutions can come out!

You can check URL Encoding values one by one via internet tables and coding, but you can also get them via a site.

For example, you can get them via a site like https://meyerweb.com/eric/tools/dencoder/.

References:

https://choseongho93.tistory.com/131

https://webkid.tistory.com/2

---

Original (Korean): tistory — published 2021-06-06, migrated to this blog. This translation was generated with the help of AI.