Username: 
Password: 
Restrict session to IP 

There is no escape  Go to the No Escape challenge

Global Rank: 229
Totalscore: 84554
Posts: 1332
Thanks: 1181
UpVotes: 694
Registered: 11y 31d




Last Seen: 15h 1m
The User is Offline
There is no escape
Google/translate5Thank You!3Good Post!0Bad Post! link
As this is more or less a training challenge, i'd like to give some general hints:

If you are doing your injections, make sure you don`t end a query with semicolon(;). The php mysql extension does not like that.

There is a trim() for all $_GET and $_POST data. This means any trailing space get`s removed.

In this challenge, the / character is filtered. So you can not use /**/ as mysql comment style. A nice working mysql comment style for this challenge is: ?vote_for= blub%20--%20foo

everything after ' -- ' is treated as comment, but the trailing space is important.

At last, let me give you a specific hint for this challenge: mysql_real_escape_string() might not work for your input!

Also keep in mind: Our exploits are mostly not simulated and "Code you see is code in use"

Good luck!
The geeks shall inherit the properties and methods of object earth.
Global Rank: 4673
Totalscore: 1993
Posts: 5
Thanks: 4
UpVotes: 4
Registered: 8y 79d
Last Seen: 3y 118d
The User is Offline
RE: There is no escape
Google/translate1Thank You!0Good Post!1Bad Post! link
Is it really possible with an MySQL-Injection? Cant pass trough the mysql_real_escape_string().
My Thougts was to manipulate simply that +1.
%20--%20 the Comment doesnt work or?

%20--%20 Shows an ErrorMessage like this:
MySqlError(1054): Unknown column 'bill -- ' in 'field list' in Query:
UPDATE noescvotes SET `bill -- `=`bill -- `+1 WHERE id=1

But all after the comment should not parsed or?
No matter the comments are only usefull if i can put a ' after my bill or george.

If another hint would break the challenge for others please write me a PM Smile
Thx for so much fun!
And sorry for my bad english iam german.
Last edited by grMf - Jan 03, 2011 - 01:10:44
Global Rank: 229
Totalscore: 84554
Posts: 1332
Thanks: 1181
UpVotes: 694
Registered: 11y 31d




Last Seen: 15h 1m
The User is Offline
RE: There is no escape
Google/translate2Thank You!1Good Post!0Bad Post! link
Look closely again how the query is build Smile
Injecting mysql in this challenge is quite easy.
The geeks shall inherit the properties and methods of object earth.
Global Rank: 4673
Totalscore: 1993
Posts: 5
Thanks: 4
UpVotes: 4
Registered: 8y 79d
Last Seen: 3y 118d
The User is Offline
RE: There is no escape
Google/translate2Thank You!2Good Post!0Bad Post! link
Thx this was close enough Smile
Great Challenge!
Global Rank: 10198
Totalscore: 48
Posts: 1
Thanks: 1
UpVotes: 1
Registered: 7y 185d
Last Seen: 6y 11d
The User is Offline
RE: There is no escape
Google/translate1Thank You!1Good Post!0Bad Post! link
Ive been trying evrything and searched for the mysql_real_escape_string(), but could get to nowhere. Can you please give me another clue ?? Please please .-) I found that the function does not excape some chars, but could find any usefull with them.

Thank you
Last edited by estenole - Sep 20, 2011 - 18:49:15
Global Rank: 229
Totalscore: 84554
Posts: 1332
Thanks: 1181
UpVotes: 694
Registered: 11y 31d




Last Seen: 15h 1m
The User is Offline
RE: There is no escape
Google/translate1Thank You!0Good Post!1Bad Post! link
There is already a very big hint in my previous post ... and you are on a good track ... keep trying!
The geeks shall inherit the properties and methods of object earth.
Global Rank: 9432
Totalscore: 82
Posts: 1
Thanks: 1
UpVotes: 1
Registered: 2y 357d
Last Seen: 2y 259d
The User is Offline
RE: There is no escape
Google/translate1Thank You!1Good Post!0Bad Post! link
Gizmore first post helps out the most as i was stuck on commenting the rest of the command
Global Rank: 3870
Totalscore: 3022
Posts: 2
Thanks: 1
UpVotes: 0
Registered: 2y 202d
Last Seen: 2y 185d
The User is Offline
RE: There is no escape
Google/translate0Thank You!0Good Post!0Bad Post! link
Huh... I kept getting errors until I added the trailing space, and now I get two green boxes (Vote counted for [INJECTION] and All votes have been reset), leading me to believe that I solved it, but it doesn't show up as solved in my challenges, and I am not on the Heroes list.
Global Rank: 1
Totalscore: 717610
Posts: 377
Thanks: 402
UpVotes: 338
Registered: 9y 234d











The User is Offline
RE: There is no escape
Google/translate1Thank You!1Good Post!0Bad Post! link
Check the code. There are two ways to get those messages, only one is the solution.
Global Rank: 3870
Totalscore: 3022
Posts: 2
Thanks: 1
UpVotes: 0
Registered: 2y 202d
Last Seen: 2y 185d
The User is Offline
RE: There is no escape
Google/translate1Thank You!0Good Post!0Bad Post! link
Hah, I got it. It just didn't like me going overboard and using 999 instead of 111 in my injection.
Redknee, dbhui1984, testlele, tunelko, silenttrack, qdxy, TheHiveMind, Z, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89 have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 15119 times.