<commit_before>---
layout: post
title: Masterpage
category: ASIS Finals 2016
---

### Description

We pwned ciphers and web services...
Yet we found another administration page which is now locked.. can you access this page?

### The Challenge

In this challenge, we were giving an ordinary login form.

![login](/assets/img/asis-finals-2016/login.png)

Upon submission of the form, we get two different behaviors.
The resulting webpage would contain either `Blocked!` or `Too long!` depending on the size of the username and password.

#### Obtaining the source code
Through a bit of recon, we discovered a `.git` folder at the root of the website :

![git_folder](/assets/img/asis-finals-2016/git_head_folder.png)

At this point, we can use [GitTools](https://github.com/internetwache/GitTools) to extract the source code of the website.
As this website is behind cloudflare, we have to update the source code of the tool a bit since
CloudFlare will block `curl` requests based on the user-agent.

In the `gitdumper.sh` script, we update the curl request with an updated user-agent :

![update_script](/assets/img/asis-finals-2016/update_script.png)

We then run the script :
![download_source](/assets/img/asis-finals-2016/download_source.png)


#### SQL injection

With the git repository at hand, we can understand how the login form works :

Run `git checkout .` to retrive the `index.php` page.

```php
<?php
...

$id = $mysql->filter($_POST['user'], "auth");
$pw = $mysql->filter($_POST['pass'], "pass");
$ip = $mysql->filter($_SERVER['REMOTE_ADDR'], "hash");<commit_msg>Fixes typo that sytten wanted me to fix<commit_after>---
layout: post
title: Masterpage
category: ASIS Finals 2016
---

### Description

We pwned ciphers and web services...
Yet we found another administration page which is now locked.. can you access this page?

### The Challenge

In this challenge, we were giving an ordinary login form.

![login](/assets/img/asis-finals-2016/login.png)

Upon submission of the form, we get two different behaviors.
The resulting webpage would contain either `Blocked!` or `Too long!` depending on the size of the username and password.

#### Obtaining the source code
Through a bit of recon, we discovered a `.git` folder at the root of the website :

![git_folder](/assets/img/asis-finals-2016/git_head_folder.png)

At this point, we can use [GitTools](https://github.com/internetwache/GitTools) to extract the source code of the website.
As this website is behind cloudflare, we have to update the source code of the tool a bit since
CloudFlare will block `curl` requests based on the user-agent.

In the `gitdumper.sh` script, we update the curl request with an updated user-agent :

![update_script](/assets/img/asis-finals-2016/update_script.png)

We then run the script :
![download_source](/assets/img/asis-finals-2016/download_source.png)


#### SQL injection

With the git repository at hand, we can understand how the login form works :

Run `git checkout .` to retrieve the `index.php` page.

```php
<?php
...

$id = $mysql->filter($_POST['user'], "auth");
$pw = $mysql->filter($_POST['pass'], "pass");
$ip = $mysql->filter($_SERVER['REMOTE_ADDR'], "hash");
{'fraction_non_alphanumeric': 0.11616954474097331, 'fraction_numerical': 0.012558869701726845, 'mean_word_length': 4.5121107266435985, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 9, 'https://': 2, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 4, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6953042', 'n_tokens_mistral': 995, 'n_tokens_neox': 925, 'n_words': 390}