Natas Level 14 Writeup: SQL Injection

1. Objective

 Find the password for natas level 15.

URL: http://natas14.natas.labs.overthewire.org

 

2. Introduction

After opening the webpage, we see a login form. We need to get the correct credentials or somehow bypass the login page in order to proceed to the next level.

 

3. Exploration

Clicking on the View sourcecode link we are able to view the logic of the server side code.

The following code snippet is used to query the database to check if the username and password are valid

	$query = "SELECT * from users where username=\"".$_REQUEST["username"]."\" and password=\"".$_REQUEST["password"]."\"";
    

However, we immediately notice that the input is not being sanitized and is being used directly in the query via string concatenation. These shows us that there is potential for sq injection

 
    SQL injection is a cyber attack that exploits vulnerabilities in web applications by 
    injecting malicious SQL code through user-input fields. This occurs when applications 
    fail to properly validate or sanitize user-provided data before incorporating it into 
    SQL queries. By manipulating input, attackers can trick the application into executing 
    unintended SQL commands, with the primary objective of gaining unauthorized access to 
    databases. SQL injection attacks may lead to unauthorized data access, modification, or 
    deletion, making it crucial for developers to implement robust input validation, 
    sanitation, and parameterized queries to mitigate the risks associated with this security 
    threat.

4. Exploit

Going back to the input form, we can enter a double quotation mark in the username field to see the result of this 

We get an error, so we can proceed to crafting an SQL statement that will always be true, so that we can bypass the login logic.

	user" or 1=1 -- -

• The double quote (") is used to close the SQL string in the query.
• "or 1=1" is a condition that always evaluates to true, effectively bypassing any user authentication.
• The double hyphen (--) is the SQL comment syntax.
• Anything after -- is treated as a comment and is ignored by the SQL engine.
• The double hyphen is used to nullify the remainder of the query, preventing errors.
• The double hyphen is followed by a space to ensure proper comment syntax.
• The closing double hyphen and space (-- -) are used to avoid issues if the injected code is followed by other SQL code.
• This injection technique is a classic example of SQL injection for unauthorized access.

5. Success

After submitting the query, we are presented with the password for the next level.

6. Prevention

It is important to validate user input before using it in the sever side code as this will prevent us from having vulnerabilities in our code.

Below is a sample of PHP code that can be considered secure enough to prevent SQLi attacks like the one we have seen in this level

  
  $host = 'your_database_host';

  $dbname = 'your_database_name';

  $username = 'your_database_username';

  $password = 'your_database_password';

  $pdo = new PDO("mysql:host=$host;dbname=$dbname", $username, $password);

  $query = "SELECT * FROM users WHERE username = :username AND password = :password";

  $statement = $pdo->prepare($query);

  $statement->bindParam(':username', $_REQUEST['username']);

  $statement->bindParam(':password', $_REQUEST['password']);
  $statement->execute();

  $result = $statement->fetchAll(PDO::FETCH_ASSOC);

  if (!empty($result)) {
    echo "Success";
  } 
  else {
    echo "Failed";
  }