webPromedium

Lab 84 — PulseView

hackadvisor

Task: Flask analytics platform with Event Explorer search vulnerable to SQL injection behind a WAF that blocks common keywords and operators. Solution: Bypass WAF using OR followed by json_extract() tautology to reveal a hidden 93rd event containing the flag in its JSON properties.

sqlite waf_bypass sql_injection flask decoy_flag honeypot_flag analytics_platform json_extract boolean_blind

decoy_flag_detectionsql_injection_via_search_parameterwaf_bypass_or_followed_by_letterjson_extract_tautologyboolean_blind_sqli_with_iifjson_extract_equality_without_equalssqlite_string_truthiness

$ ls tags/ techniques/

sqlite waf_bypass sql_injection flask decoy_flag honeypot_flag analytics_platform json_extract boolean_blind

decoy_flag_detectionsql_injection_via_search_parameterwaf_bypass_or_followed_by_letterjson_extract_tautologyboolean_blind_sqli_with_iifjson_extract_equality_without_equalssqlite_string_truthiness

Analysis

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat.

$ python3 exploit.py --target 192.168.1.1 --port 8080
[*] Connecting to target...
[+] Shell obtained!

Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.

Permission denied (requires tier.pro)

Sign in to access full writeups

$sign in

$ cat writeup.md…

Sign in to access full writeups

Sign in to access full writeups

Similar writeups