Webverselabs Challenge BackAisle SQLi

Scenario :

Yardlines built their storefront on a long weekend in 2022. The category filter on the shop page was the kind of throwaway code you write at 2am with a deadline tomorrow — quick, direct, never revisited. They added a friends-and-family capsule program in 2024 and bolted a second visibility rule onto the same code path, figuring nobody could tell that capsule pieces existed if they weren’t on the public grid. The grid is just one view of the data.

Solution :

We first start by exploring the app just like a normal user would . Try and see different endpoints, features, etc…

Then we check Burp’s History to see if we find any interesting requests, we’re mainly looking for parameters that we can inject whether it be a parameter in the URL or a GET Request or inside the body of a POST Request .

/Shop :

This endpoint just gives us a list of products that we can view, buy etc , usually each product will have an id which we will find in the GET request .

Well we don’t have an ID , but at least we find a parameter that we can use to inject , i first injected a simple payload to trigger the sqli . Which didn’t cause any errors which is not a good sign .

Just to be sure i still used sqlmap to try and test this parameter :

https://github.com/sqlmapproject/sqlmap
python3 sqlmap.py -u "https://bba07957-4327-back-aisle-124e4.challenges.webverselabs-pro.com/product.php?slug=field-jacket-olive" --level=5 --risk=3 --batch

Unfortunately, this didn’t work either. Let’s just keep looking for now.

/Drops :

New parameter , again i injected a simple payload “’” to try and cause an error .

Perfect, but we can’t confirm still that this is an SQLi for sure, now if we add another ‘ this should close the query and we shouldn’t get an error , if this works this is also a huge indidcator that this parameter is indeed vulnerable.

And we do get rid of the error , now that we know this might be vulnerble we can use sqlmap to try and dump the entire Database .

Another way to confirm the SQLi is by commenting the rest and see if this solves the error , for example we inject

'-- - : This should comment the Rest of the query so we won't have an issue breaking the syntax which should remove the error we got earlier .

Now moving on to sqlmap — make sure to add –random-agent since the firewall fingerprints and blocks sqlmap’s default User-Agent.

python3 sqlmap.py -u "https://bba07957-4327-back-aisle-124e4.challenges.webverselabs-pro.com/shop.php?category=*" --batch --random-agent

Without it, even adding up –level 5 –risk 3 won’t help , the request gets blocked before sqlmap even gets a chance to test payloads.

Simply randomizing the User-Agent was enough to bypass the firewall and get sqlmap running successfully.

Finally we just dump the entire DB to get the flag :

That was all for this challenge . See you in the next one :)