[LOOOP]

Hey, BF new challenge is here

[paven]

Link - https://app.hackthebox.com/challenges/0xboverchunked

[antigoth]

Working on it, I figured out you can bypass the waf.php filter to circumvent "OR" by doing "o+r" .
the flag is obivously at id=6 from reading the code which is blocked

it doesn't see 5 + 1 as 6 though, just an invalid ID

[peRd1]

It can be done with a very well formulated sqlmap query as well. Just don't forget about the flags, level, risk, random agent, etc.

And think about which endpoint, what you want to search for, and dump that shit.

It's going to find some injection parameter that can be abused of course...

[cavour13]

I read all the code but i couldn't bypass waf ! tried also with sqlmap -r req{http post request `Controllers/Handlers/SearchHandler.php`} with --level 5 --risk 3 --dump

[xa6]

sqlmap is unintended afaik

[dhzzz]

6' AND CASE WHEN gamedesc LIKE 'HTB{%}' THEN 1 ELSE load_extension(1) END -- -

I dumped the flag with this sqli but its not case sensitive, REGEXP and COLLATE doens't seems to work...

[Steward]

6' AND CASE WHEN gamedesc LIKE 'HTB{%}' THEN 1 ELSE load_extension(1) END -- -

I dumped the flag with this sqli but its not case sensitive, REGEXP and COLLATE doens't seems to work...

how could you dump anything with the request that contains quote? 
you should get response "SQL Injection attempt identified and prevented by WAF!" because your request contains '

[dhzzz]

6' AND CASE WHEN gamedesc LIKE 'HTB{%}' THEN 1 ELSE load_extension(1) END -- -

I dumped the flag with this sqli but its not case sensitive, REGEXP and COLLATE doens't seems to work...

how could you dump anything with the request that contains quote? 
you should get response "SQL Injection attempt identified and prevented by WAF!" because your request contains '

Transfer-Encoding: chunked

[isac37M]

6' AND CASE WHEN gamedesc LIKE 'HTB{%}' THEN 1 ELSE load_extension(1) END -- -

I dumped the flag with this sqli but its not case sensitive, REGEXP and COLLATE doens't seems to work...

how could you dump anything with the request that contains quote? 
you should get response "SQL Injection attempt identified and prevented by WAF!" because your request contains '

Transfer-Encoding: chunked

It's giving me internal server error. Any idea?