Rating: 5.0
# Challenge Name: secure
## Description
Just learned about encryption—now, my website is unhackable!
Author : BrownieInMotion
[index.js](index.js)
## Detailed solution
Opening the challenge link https://secure.mc.ax/
It's a classic login page that use POST with username and password to /login
```javascript
<script>
(async() => {
await new Promise((resolve) => window.addEventListener('load', resolve));
document.querySelector('form').addEventListener('submit', (e) => {
e.preventDefault();
const form = document.createElement('form');
form.setAttribute('method', 'POST');
form.setAttribute('action', '/login');
const username = document.createElement('input');
username.setAttribute('name', 'username');
username.setAttribute('value',
btoa(document.querySelector('#username').value)
);
const password = document.createElement('input');
password.setAttribute('name', 'password');
password.setAttribute('value',
btoa(document.querySelector('#password').value)
);
form.appendChild(username);
form.appendChild(password);
form.setAttribute('style', 'display: none');
document.body.appendChild(form);
form.submit();
});
})();
</script>
```
Let's check the [index.js](index.js) file. Here is the login part
```javascript
app.post('/login', (req, res) => {
if (!req.body.username || !req.body.password)
return res.redirect('/?message=Username and password required!');
const query = `SELECT id FROM users WHERE
username = '${req.body.username}' AND
password = '${req.body.password}';`;
try {
const id = db.prepare(query).get()?.id;
if (id) return res.redirect(`/?message=${process.env.FLAG}`);
else throw new Error('Incorrect login');
} catch {
return res.redirect(
`/?message=Incorrect username or password. Query: ${query}`
);
}
});
```
To be able to get the flag we need to make the query true without knowing the username and password
Let's perform some sql injection in the password parametre. I'm gonna use burp
Capture the post request while logging in and focus the password parametre
Use some payloads from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/Intruder/Auth_Bypass.txt
We got our flag we can url decode it from that alert parametre or check the success page
## Flag
```
flag{50m37h1n6_50m37h1n6_cl13n7_n07_600d}
```
