Skip to content

challenge_2.md

Latest commit

 

History

History
34 lines (22 loc) · 1.54 KB

challenge_2.md

File metadata and controls

34 lines (22 loc) · 1.54 KB
Raw

sql-injection Challenge 2

Friend, you've got to help me out!

I was looking at my database earlier today, and found an account with 9999999 crystals (which is one of the currencies in my game). It is impossible for them to get that number legitimately, that many crystals don't even exist in my game!

Can you look into it and see if you can find the hole through which this user obtained so many crystals? If you could duplicate the bug, I can fix it. A good place to start would likely be the Crystal Market on the Explore page. Feel free to explore the source code as well if that helps.

Thanks!

-Breakthenet Game Owner

Stuck?

Click for hint 1 [Here is the code](https://github.com/breakthenet/sql-injection-exercises/blob/master/cmarket.php#L109) associated with buying crystals from the crystal market. Anything stick out to you?
Click for hint 2 Always start with reconnaissance. Did you look for the sql definition of the [Crystal Market table](https://github.com/breakthenet/sql-injection-exercises/blob/master/dbdata.sql#L343-L348)?
Click for hint 3 SQL Injection in PHP has some limitations - you cannot concatenate multiple queries with a semi-colon, for example. However, there are alternatives. Here's [this](http://www.mysqltutorial.org/sql-union-mysql.aspx) and [this](http://dev.mysql.com/doc/refman/5.7/en/union.html) to get you started.