Username: 
Password: 
Restrict session to IP 

There is no escape  Go to the No Escape challenge

Global Rank: 252
Totalscore: 87267
Posts: 1635
Thanks: 1336
UpVotes: 885
Registered: 16y 42d




Last Seen: 3h 28m
The User is Offline
There is no escape
Google/translate5Thank You!3Good Post!0Bad Post! link
As this is more or less a training challenge, i'd like to give some general hints:

If you are doing your injections, make sure you don`t end a query with semicolon(;). The php mysql extension does not like that.

There is a trim() for all $_GET and $_POST data. This means any trailing space get`s removed.

In this challenge, the / character is filtered. So you can not use /**/ as mysql comment style. A nice working mysql comment style for this challenge is: ?vote_for= blub%20--%20foo

everything after ' -- ' is treated as comment, but the trailing space is important.

At last, let me give you a specific hint for this challenge: mysql_real_escape_string() might not work for your input!

Also keep in mind: Our exploits are mostly not simulated and "Code you see is code in use"

Good luck!
The geeks shall inherit the properties and methods of object earth.
Global Rank: 6179
Totalscore: 2020
Posts: 5
Thanks: 4
UpVotes: 4
Registered: 13y 91d
Last Seen: 3y 282d
The User is Offline
RE: There is no escape
Google/translate1Thank You!0Good Post!1Bad Post! link
Is it really possible with an MySQL-Injection? Cant pass trough the mysql_real_escape_string().
My Thougts was to manipulate simply that +1.
%20--%20 the Comment doesnt work or?

%20--%20 Shows an ErrorMessage like this:
MySqlError(1054): Unknown column 'bill -- ' in 'field list' in Query:
UPDATE noescvotes SET `bill -- `=`bill -- `+1 WHERE id=1

But all after the comment should not parsed or?
No matter the comments are only usefull if i can put a ' after my bill or george.

If another hint would break the challenge for others please write me a PM Smile
Thx for so much fun!
And sorry for my bad english iam german.
Last edited by grMf - Jan 03, 2011 - 01:10:44
Global Rank: 252
Totalscore: 87267
Posts: 1635
Thanks: 1336
UpVotes: 885
Registered: 16y 42d




Last Seen: 3h 28m
The User is Offline
RE: There is no escape
Google/translate2Thank You!1Good Post!0Bad Post! link
Look closely again how the query is build Smile
Injecting mysql in this challenge is quite easy.
The geeks shall inherit the properties and methods of object earth.
Global Rank: 6179
Totalscore: 2020
Posts: 5
Thanks: 4
UpVotes: 4
Registered: 13y 91d
Last Seen: 3y 282d
The User is Offline
RE: There is no escape
Google/translate2Thank You!2Good Post!0Bad Post! link
Thx this was close enough Smile
Great Challenge!
Global Rank: 15796
Totalscore: 68
Posts: 1
Thanks: 1
UpVotes: 1
Registered: 12y 197d
Last Seen: 11y 22d
The User is Offline
RE: There is no escape
Google/translate1Thank You!1Good Post!0Bad Post! link
Ive been trying evrything and searched for the mysql_real_escape_string(), but could get to nowhere. Can you please give me another clue ?? Please please .-) I found that the function does not excape some chars, but could find any usefull with them.

Thank you
Last edited by estenole - Sep 20, 2011 - 18:49:15
Global Rank: 252
Totalscore: 87267
Posts: 1635
Thanks: 1336
UpVotes: 885
Registered: 16y 42d




Last Seen: 3h 28m
The User is Offline
RE: There is no escape
Google/translate1Thank You!0Good Post!1Bad Post! link
There is already a very big hint in my previous post ... and you are on a good track ... keep trying!
The geeks shall inherit the properties and methods of object earth.
Global Rank: 14339
Totalscore: 114
Posts: 1
Thanks: 1
UpVotes: 1
Registered: 8y 4d
Last Seen: 7y 270d
The User is Offline
RE: There is no escape
Google/translate1Thank You!1Good Post!0Bad Post! link
Gizmore first post helps out the most as i was stuck on commenting the rest of the command
Global Rank: 5039
Totalscore: 3089
Posts: 2
Thanks: 1
UpVotes: 0
Registered: 7y 214d
Last Seen: 7y 196d
The User is Offline
RE: There is no escape
Google/translate0Thank You!0Good Post!0Bad Post! link
Huh... I kept getting errors until I added the trailing space, and now I get two green boxes (Vote counted for [INJECTION] and All votes have been reset), leading me to believe that I solved it, but it doesn't show up as solved in my challenges, and I am not on the Heroes list.
Global Rank: 1
Totalscore: 760035
Posts: 431
Thanks: 491
UpVotes: 456
Registered: 14y 246d












The User is Offline
RE: There is no escape
Google/translate1Thank You!1Good Post!0Bad Post! link
Check the code. There are two ways to get those messages, only one is the solution.
Global Rank: 5039
Totalscore: 3089
Posts: 2
Thanks: 1
UpVotes: 0
Registered: 7y 214d
Last Seen: 7y 196d
The User is Offline
RE: There is no escape
Google/translate1Thank You!0Good Post!0Bad Post! link
Hah, I got it. It just didn't like me going overboard and using 999 instead of 111 in my injection.
Redknee, dbhui1984, testlele, tunelko, silenttrack, n0tHappy, quangntenemy, TheHiveMind, Z, balicocat, Ge0, samuraiblanco, arraez, jcquinterov, hophuocthinh, alfamen2, burhanudinn123, Ben_Dover, stephanduran89, braddie0, SwolloW, dangarbri have subscribed to this thread and receive emails on new posts.
1 people are watching the thread at the moment.
This thread has been viewed 17607 times.