Webverselabs Challenge Trace Control SQLi

Scenario :

Trackboard is a self-hosted issue tracker maintained by a four-person platform team at a mid-size adtech firm in Austin, in use internally since 2019. Last Thursday’s emergency hotfix was cut from a staging branch nobody had remembered to align with prod, and the on-call who pushed it left for a long weekend the next morning. You’ve got a few hours before the next deploy — make them count.

Solution :

We first start by navigating the app just like a normal user would , check different endpoints , use different features , then check Burp’s History to see if we got any interesting requests made to the server.

We’re mainly looking for parameter where we can inject , the goal is to see if we can cause an internal error by messing up the query’s quotations .

/Projects Issues:

This is a list of projects ,notice how there is a parameter in the GET request , if we try to inject a simple payload o break the sql query :

We see that we don’t get any errors , we can also confirm that the endpoint is indeed not vulnerable if we use sqlmap .

Moving on to the Search feature :

We also see a parameter inside the URL which means we can test it as well .

We can’t really cause an error , i also tried SQLmap but that didn’t work either.

/New Issue :

We can create a new Issue , if we look at the reqeuest :

We see that it is a redirection to /issue.php :

We notice that there is a parameter this time, we can try injecting inside that parameter before we inject the original POST Request (i didn’t immediately go for the POST request since it is a redirect so it will be harder to test).

If we also go back to the Overview endpoint, we see that our Issue was created.

Now if we click on any of the isse we go back to where we were once we created the Issue , from here we said we were going to try and inject the id parameter as well before moving to the POST Request .

Perfect, we managed to cause an error , which also gives us the DB used , which in this case is MariaDB.

To save time , we can use SQLmap now that we know for sure the parameter is vulnerable and the DB is MariaDB , just make sure that you modify the user-agent since sqlmap uer agent is always blocked by any firewall.

Perfect, it s a time based SQLi .

I first ran this :

python3 sqlmap.py -u https://69ce1775-4327-trace-control-1c416.challenges.webverselabs-pro.com/issues.php?id= --random-agent --batch --skip-heuristics --dbms=MariaDB --dump

But it took so long since it is a Time based SQLi .

So once it identified the DB name as well as the Table name , i used them to retrieve the flag faster .

python3 sqlmap.py -u https://69ce1775-4327-trace-control-1c416.challenges.webverselabs-pro.com/issues.php?id= --random-agent --batch --skip-heuristics --dbms=MariaDB --dump -D chalapp -T admin_flags --threads=10

Perfect, we’re able to retrieve the flag.

That was all for this challenge, see you in the next one.