> For the complete documentation index, see [llms.txt](https://khalid-emad.gitbook.io/cyber-sec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://khalid-emad.gitbook.io/cyber-sec/zixem-challenges.md). # Zixem Challenges > **Zixem , Series of challenges that focuses on Union SQL attacks** . **We are required in every challenge to select the version and the username** [**https://www.zixem.altervista.org/SQLi/**](https://www.zixem.altervista.org/SQLi/) ### Level 1 We first see this web page which displays products based on a GET parameter called `id` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FQXw2PLhQEHzCuAUlZb8D%2Fimage.png?alt=media\&token=10d5630d-cde4-4b99-9c75-04612aef9899) Since we only allowed to use union so let's check how many rows are being returned By using this payload => `1'+union+select+1--+-` we got this error : ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FzQM5WxzoAvW9K89Cl86g%2Fimage.png?alt=media\&token=788cee84-749e-4168-8a68-9365ddb1b64f) So maybe the id value is passed as an integer so we don't need to add the quote : `1111+union+select+1--+-;` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FMPCMySbTMz4vubky21Zw%2Fimage.png?alt=media\&token=5819c3e1-e593-4aef-aaf5-20bdb42ab43a) Nice let's increment the numbers until this message disappear ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FgqJyDQ8EyRc5tMzZsTQE%2Fimage.png?alt=media\&token=b90ff750-812a-471d-bcb8-18fd7e5e0e06) We can see that it returns 3 columns only the first 2 are displayed , user and version can be easily selected as follow : `111+union+select+version(),user(),3--+-` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FniYEjmsXzmYlXL9HLEnT%2Fimage.png?alt=media\&token=d5eefccc-ebc6-41f8-9ab2-1348e796c330) ### Level 2 Level 2 was like level 1 but instead the id parameter in this level is passed as a string so we need to add a quote to escape the query . Final query : `444'+union+select+user(),version(),3,4--+-;` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FNMdPhe0C6n0w15U6KimX%2Fimage.png?alt=media\&token=176afc89-56e7-49c1-8b8c-4cc858302d70) ### Level 3 Another web page which displays products based on a GET parameter `item` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FIC3xqSEgQhngd9Ug58jF%2Fimage.png?alt=media\&token=c120a057-c65a-49f6-9725-1a89b2d2cd66) If we tried to manipulate the query as follow : `33'+union+select+1--+-;` we get this error ![letters "on" are deleted](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FuMUcvnBmOK0PivKlc3hx%2Fimage.png?alt=media\&token=6cf8763e-2b8e-42a4-909c-d6f2d96a8ed7) Maybe they are filtering for just the letters "on" ? let's try "ON" to see what happens ![Same thing](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2F9LoPWqN3GJPn13waRVuW%2Fimage.png?alt=media\&token=744cd038-ffd7-42ba-9aa5-fea5c5d8619b) Ok , let's add another "on" to the word union to be like this unionon so that when the filter deletes "on" we still have the word union ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FyKtpXXHd9IkJq3zIH59z%2Fimage.png?alt=media\&token=5ab1b650-ad69-4b33-89d5-5fc5f433f6ee) We got different says that there are more columns returned , so the solution was effective . Increasing the numbers until we got 4 columns returned , only the first 3 are displayed , user and version can be selected as follow : `333+unionon+select+user(),version(),3,4--+-;` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2F055H1jMebKUZ5ynseHud%2Fimage.png?alt=media\&token=c8a2973a-df63-416d-8470-4ac0031785d7) ### Level 4 Level 4 is as easy as level 2 but it expects 5 columns . Final query to select the user and the version : `111'+union+select+1,2,user(),version(),5--+-;` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FdHyG9ubB49nfestrfOu6%2Fimage.png?alt=media\&token=30fa3785-47d1-4c6a-811e-70683721c052) ### Level 5 Level 5 was a brute forcing one and not relevant to SQL injection, however i've solved it on my github repo ### Level 7 As usual a simple web page that displays content based on a parameter ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FzidONUgYoWkrFCWDGnJw%2Fimage.png?alt=media\&token=a80a6bc8-128c-4902-a04b-a3a1888a0da1) When we try to manipulate the id parameter we get nothing , what ever we add from quotes and numbers and dashes the web page is completely static and no errors \[ Give it a try by yourself ] Until we take a look on the source code ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FIlvPL0vnWdulZKdzJmHS%2Fimage.png?alt=media\&token=8f3e9794-f57b-49c0-8f57-8c229e30c638) We have this hidden element which holds a value that tells us whether the query is correct or not , If i changes this id to any other value i get an error : ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FZg8asuVlDTJz1O9tHlPu%2Fimage.png?alt=media\&token=af7c45a4-0452-4926-82b5-433dc93e2424) So the key here is to discover how much columns are returned according to this value ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FNc7bEqbhpTbsH3qzeARY%2Fimage.png?alt=media\&token=1f7a6767-1054-40b4-b823-4c5882e22a1a) So with little errors we manage to get the correct query , and also the column number 2 is displayed beside the word "ok" , so we can select the user as follow ``` // Selecting user 12' union select 1,user(),3-- -; // Selecting version 12' union select 1,version(),3-- -; ``` ### Level 8 ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FEao7Rbdi1BMQX4fSJYy9%2Fimage.png?alt=media\&token=61b4dbf9-0033-4767-9013-c64eae4f7dd3) We are facing a web page that has a GET parameter id with patrick greeting us , so let's try a simple payload like `'+union+select+1--+-;` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FPr6A7R9srehQacZM3Nrk%2Fimage.png?alt=media\&token=04460573-1ce1-42ed-afb7-77853c4baadf) Our query is being filtered now , My preferred approach for bypassing the filter is to re-write the payload again character by character and observe the results ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FsfE4sGVDUvog2lgA7Yoe%2Fimage.png?alt=media\&token=c55a02fc-c18a-44b7-a7e2-51b2b1a3c2b8) We can see that the `+` operator triggers the filter , + operator is the URL encoding of a white space , so we can replace it by double URL encoding or inline comments `/**/` but none worked for me , so i read a simple writeup showing case of using the carriage return character `%0D` and it succeeded to bypass the filter for white space , so let's re-write it again : used payload => `1%0Dunion%0Dselect%0D1--%0D-;` the result i got => ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2F7FVeohufVAqEsUKaepgL%2Fimage.png?alt=media\&token=fb452420-be7b-4095-a51b-6b392c39a873) We can see that the `select` word has been removed let's add an inline `select` word like we did before to be `se`*`select`*`lect` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FavXYsvyzjjKmeky9b0P2%2Fimage.png?alt=media\&token=33e86b71-139d-434d-a331-d740c5c1f692) Nice , all we need now is to find number of columns , by increasing the number we found that it needs 3 columns and the first 2 are reflected. We can easily select the version and user now : ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2Fjj9ySaWcOBGgZBm0IfB0%2Fimage.png?alt=media\&token=50fa1f01-81f5-48a6-b95d-e9ccff6f9664) ### Level 9 This time the challenge is different as we are required to display the contents of `/etc/passwd` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FG0LXU0cDQ7jfkwHGDneU%2Fimage.png?alt=media\&token=ed2e1002-6d3c-4f72-81c9-a060e54f8549) We see a simple GET parameter called `id` , so let's try to inject a union payload to it : ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FziKEF2jqQ3Tj1L5Js84g%2Fimage.png?alt=media\&token=3d439b92-e2f2-4bd5-9bbc-7581ea43fcf2) More columns needed and we got another that it can't require something . ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FYpgXVshcCeJV0Zw76sqV%2Fimage.png?alt=media\&token=60937f63-7fcf-4efd-af8b-cd8eb617dae3) It accepts only 2 columns and also requires the column number 1 , so let's add the file name as a column : `../etc/passwd` ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FtaAyKo69rXsXpyJaMtyi%2Fimage.png?alt=media\&token=fca21ce5-1f9d-40e3-851e-c5e7e0e279af) ### Level 10 When we open the challenge we found a GET parameter called `x` which has a base64 encoded value ``` https://www.zixem.altervista.org/SQLi/lvl10.php?x=ISwwYGAKYAo%3D ``` When we attempt to decode it , we find a very strange result : ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2F53XZhs9V3iyN5ACciu3C%2Fimage.png?alt=media\&token=5665d885-ad54-46c5-9ece-414a0ee06c99) Honestly i thought that this a dead end and i looked at the source code hoping for additional info ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FtpGLOGVwM1Dv4bjjYnvG%2Fimage.png?alt=media\&token=5cf7819d-7e35-4eda-a51e-5ac3bb917e44) After this hint i knew that the decoded value is called `uuencoded string` so i went for online decoder to see what it holds ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2Fk6ExAk56Xen9y5xd71Aa%2Fimage.png?alt=media\&token=19f83da3-c130-4930-ae8a-f119c4ee8067) So the value of x was 1 , but uuencoded then base64 encode . Now let's create our payload and encode it ![uuencoding our payload](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2F4E4R6U0xvmR9mt8KsJXj%2Fimage.png?alt=media\&token=3b1f4295-0e82-4048-9172-fae80d39741d) ![base64 encoding the string ](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FB32trIAFJtcI8GqCqRQU%2Fimage.png?alt=media\&token=aaf09eaa-d31f-4e6c-877b-bd9010468c93) We can now try to inject the parameter x with the base64 string ![](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FWvdQyRMe4fUDxWuOcyHa%2Fimage.png?alt=media\&token=9ebe38e1-84e4-4f2c-bfe1-6760e8ef0b80) Now it is a process of determining number of columns then selecting the version. {% hint style="info" %} Remove the quote from number 1 in the payload because it is being parsed as integer not string , this caused me an error in the beginning {% endhint %} ![You can use CONCAT function to concatenate strings ](https://49018334-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FQa5lZLJzKij2hNo1ER5S%2Fuploads%2FRVAls8gRFoXDBQfOcIE9%2Fimage.png?alt=media\&token=83224b70-69ed-4342-bced-e0799303878e)