Zark0
7 years ago

0

Hi all,

This is my first post so please be understanding :D

I just need to know if my reflection is good or not :D

actually i try something like this :

‘ or realname='Sandra Murphy’ or 1=1

and some random character in the password.

Normally the instruction will be something like this

username = $_GET[username] AND password = $_GET[password]

so if I want to remove the and I need to add a OR condition so my injection will be like

username = $_GET[username] OR realname='Sandra Murphy' OR 1=1 AND password=$_GET[password]

If i make the translation :

0 OR 1 OR 1 AND 0

But that didn’t works, what’s wrong, my comprehension ? i make a stupid mistake like forgot a '

please could you help me ?

Thanks

? [bolofecal]
7 years ago

0

You forgot something

[quote=Intermediate Level 6]This login screen is trying something a bit different and is not using SQL.[/quote]

?

Zark0
7 years ago | edited 7 years ago

0

hum i didn’t forget it but maybe misconception of this point

the request isn’t something like this

$xpath = “//user[username=‘” . $GET['username’] . “‘ and password=’” . $GET[‘password’] . “‘]”;[/Spoiler]

so if i had my line the new xpath is :

[Spoiler]$xpath = “//user[username=‘” . $GET['username’] . ‘ or realname='Sandra Murphy’ or 1=1 “‘ and password=’” . $GET[‘password’] . “‘]”;

? [bolofecal]
7 years ago

0

This @freewind1012 code may helps https://www.hackthis.co.uk/forum/level-discussion/intermediate-levels/intermediate-level-6/3696-intermediate-6-help I suggest you simulate in your own host if you can not complete.

?

Zark0
7 years ago

0

Hi,

First thanks for your help, I read the post and try some different thing

now i try to put that into the username

‘or '1’=‘1’ or realname/text()=‘Sandra Murphy

and something random in the password .

that didn’t work.

is my reflection totally wrong ? I try with the code from freewind2012 with some modification :

$query = "//user[username/text() = '" . $username . "' and realname/text() = '" . $realname . "' and password/text() = '" . $password . "']";

$username = "'or '1'='1' or '1'='1"; $password = "'or realname/text()='cool";

like this it works

Logical Help

Sandra Murphy

0

0

?

0

0

?

0