Webverselabs Challenge Tradesman SQLi

Scenario :

Stylus Hi-Fi is a vintage record marketplace based in Portland — sellers list their inventory, buyers search by Goldmine grade, the platform takes 8%. The public marketplace went through three frontend rewrites since 2017. The seller dashboard hasn’t. Login still goes through the original query.

Solution :

We first start by navigating the application just like a normal user, to check different endpoints and features, then we check Burp’s History to see if we find anything interesting . We’re mainly looking for parameters where we can inject.

/Browse !

This is a list of Products , at first i thought clicking on any of them will shows us a parameter inside of the GET request that we can use to injetc but that wasn’t the case :

I knew it wasn’t going to work but i even tested to inject the URL still , but that just returned an error .

You can try SQLmap but due to the request not having any parameters to inject, it won’t be useful either.

Now moving on, we find the Apply endpoint where we can apply to start posting our products and sell on the website as well.

But apparently this endpoint doesn’t work either. It’s just a static web page that is returned to us .

Now the last thing we’ve got left is the Sign in endpoint :

Now if we send a normal Request :

We see that when we login , it makes a POST request to the /seller/login endpoint , with our username and password .

Now whenever we have a login page , first thing you should think of is Auth Bypass via SQL injection . Now there are so many payload we can test , here is a LIST of them :

https://gist.github.com/spenkk/2cd2f7eeb9cac92dd550855e522c558f

I decided to use FFUF , and inject all of these payloads in the username field , and finally filter for the Response we find in a failed Response : Invalid handle or password .

First we put all the payloads in a file :

Then we craft the FFUF Request , it is pretty simple , just make sure you add all necessary parameters SPECIALLY “Content-Type: application/x-www-form-urlencoded” since we are passing Special characters and for the rest of the request it should be pretty simple since we already have the Burp Request :

 ffuf -X POST -u https://9ba0dee6-4327-tradesman-d1afa.challenges.webverselabs-pro.com/seller/login \
-H "Content-Type: application/x-www-form-urlencoded" \
-d "handle=FUZZ&password=aaaaaaaa" \
-w Auth_bypass_list \
-fr "Invalid handle or password"

Perfect, a Redirect , which means we’re logged in , let’s try any of these :

And just like that we’re in :

The flag can be found under the Admin Notes endpoint :

That was all for this challenge, see you in the next one :)