{"id":460,"date":"2025-02-09T14:49:16","date_gmt":"2025-02-09T13:49:16","guid":{"rendered":"https:\/\/bergee.it\/blog\/?p=460"},"modified":"2026-04-27T22:18:25","modified_gmt":"2026-04-27T20:18:25","slug":"how-i-hacked-xxxx-for-fun-and-profit","status":"publish","type":"post","link":"https:\/\/bergee.it\/blog\/how-i-hacked-xxxx-for-fun-and-profit\/","title":{"rendered":"How I hacked XXXX for fun and !profit"},"content":{"rendered":"

I am a little bit late but Happy New Year \ud83d\ude42<\/p>\n

In the beginning of the year I decided to hack one company, let’s call it XXX as I can’t give the real name. The company is running VDP program and offers only letters of appreciacion. So I wanted to get one. I started my recon by google dorking with these dorks:<\/p>\n

site: *.XXX ext:jsp<\/p>\n

site:*.XXX ext:php<\/p>\n

site:*.XXX ext:asp<\/p><\/blockquote>\n

I found the JSP site, looking pretty legacy, which allowed some data searching. So I ran the BURP and started playing with the site. I looked through the requests one by one but found nothing pretty interesting. So I started testing parameters for XSS, html injection but found nothing. I also tried array-based injection\u00a0 – instead of value I put [] as an array, it often leads to unexpected results, but nothing. I also tried\u00a0 adding ‘ to the end of parameters, hoping for SQL error or at least error 500 which could indicate blind SQL injection but nothing. One mistake I made back then was I omitted some parameteres and focused only on \u00a0the one\u00a0 getting the user input value directly, not the one that were kind of control parameters adding by the app itself.<\/p>\n

I was about to give up but somehow I put ‘ in the end of the control parameter. Suddenly, in the response I saw an SQL error… what? Good old SQL injection just like that? Yes that was it. This is heavily redacted request:<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Ok, I’ve got the SQL injection, but what now. To prove the impact I had to extract some real data such as username, database name or tables name. The error points to Oracle database which fortunately I am pretty familiar with as the developer\u00a0 but not from the SQL injection point of view :). At first I figured out I can post only this one parameter (type) to throw the error. The error says it is procedure, so we can assume the sql is something like:<\/p>\n

begin some_procedure(param1,param2,type); end;<\/p><\/blockquote>\n

that’s why I tried to close the query and see what happened:<\/p>\n

type=All’); select 1 from dual; end;–<\/p><\/blockquote>\n

but another error has happend. I was trying some more payloads to end the query and begin another one, always ending up with some errors. I took a break.<\/p>\n

Several hours later I came back with the fresh mind and new idea – what if I concatenate the value of type parameter with something else , so the injection would be:<\/p>\n

type=x’||’abc’)–<\/p><\/blockquote>\n

and guess what? It worked , there was no error and I got no data , means that’s the right way of exploiting that. Now I had to check if I can run my own queries. I tried this:<\/p>\n

type=x’||(select ‘abc’ from dual))–<\/p><\/blockquote>\n

and I got some strage syntax error. I figured out this might be due to the space signs so I recall the old trick replacing them with sql comments , so the we got this payload now:<\/p>\n

type=x’||(select\/**\/’abc’\/**\/from dual))–<\/p><\/blockquote>\n

This worked perfectly. Again\u00a0 – success – no error and no data. But If a get no data in response how can I retrieve anything? The answer is special oracle function that returns the data inside of the error message. After some googling I found the perfect candidate for this:<\/p>\n

ctxsys.drithsx.sn(1,(sql query to execute))<\/p><\/blockquote>\n

And to be honest, I don’t know what this function is doing, but this query returned the username (starting with N in this picture) as the part of the error message:<\/p>\n

type=x’||(ctxsys.drithsx.sn(1,(select\/**\/user\/**\/from\/**\/dual))))–<\/p><\/blockquote>\n

\"\"<\/p>\n

I also extracted database name with the following payload:<\/p>\n

type=x’||(ctxsys.drithsx.sn(1,(select\/**\/ora_database_name\/**\/from\/**\/dual))))–<\/p><\/blockquote>\n

Finally I sent the report and got P1 two days later.<\/p>\n

Reward: letter of recognition<\/p>\n

See you next bug<\/p>\n","protected":false},"excerpt":{"rendered":"

I am a little bit late but Happy New Year \ud83d\ude42 In the beginning of the year I decided to hack one company, let’s call it XXX as I can’t give the real name. The company is running VDP program and offers only letters of appreciacion. So I wanted to get one. I started my…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[33,29],"tags":[22],"class_list":["post-460","post","type-post","status-publish","format-standard","hentry","category-vdp","category-write-up","tag-sql-injection"],"_links":{"self":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/460","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/comments?post=460"}],"version-history":[{"count":8,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/460\/revisions"}],"predecessor-version":[{"id":477,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/posts\/460\/revisions\/477"}],"wp:attachment":[{"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/media?parent=460"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/categories?post=460"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bergee.it\/blog\/wp-json\/wp\/v2\/tags?post=460"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}