Webverselabs Shadow Registrar SQLi

Scenario:

RegistryPro is a domain registrar that has been quietly serving small hosting resellers out of Dublin since 2008, with a public lookup page that has barely changed since the original CTO wrote it. A junior on the UX team redesigned the terminal last spring, surfaced a few extra diagnostics in the response, and shipped the change without anyone on the backend side reviewing what those diagnostics actually exposed. The original CTO retired in 2021 and nobody else really knows the driver layer.

Solution :

First thing first , we start by navigating the application like a normal user , try different endpoints to see what response we get , then we check the Burp History to see the content of each of our requests .

We see the /dns.php which has the domain_id parameter , first thing i would think of is trying to inject in that parameter field to see if it’s vulnerable , after trying multiple SQLi payloads we don’t get anything useful in return , server doesn’t return internal errors , time based payloads don’t cause any delays , let’s keep looking .

Let’s take a look at the /whois.php endpoint :

Let’s try to inject the domain parameter , i like using this time based SQLi payloads from lostsec :

https://github.com/coffinxp/customBsqli/blob/main/payloads/generic.txt

Huge indicator that this parameter might be injectable is the error we get once we add ‘ to the domain field .

Now let’s some of the Time based payloads from the github page , personally i used this one which worked just fine confirming that we got a Time based SQLi .

'; SELECT BENCHMARK(10000000,MD5(1)); -- -

Now we can use sqlmap , specify that it is vulnerable to time based , and since this payload is for Mysql we know that this is the DB being used .

Perfect , now sqlmap can find that it is vulnerable as well :

For time based SQLi , you can use a Tool named Ghauri as well , it is better for time based than sqlmap but for this one sqlmap will work just fine for us , Now all we need to do is dump the tables , and let it run for a while since this is time based sqli , it will take a bit logner .

And we get our flag this way , this is it for this challenge , see you in the next one :)