Skip to content

Instantly share code, notes, and snippets.

@antoniomika

antoniomika/getUser.php

Created March 11, 2016 21:01
Show Gist options
  • Save antoniomika/4d88a47a542a456532ca to your computer and use it in GitHub Desktop.
Save antoniomika/4d88a47a542a456532ca to your computer and use it in GitHub Desktop.
Download ZIP
Simple Vulnerabilities for Michigan Hackers CTF
Raw
getUser.php
<?php
$username = $_GET['username'];
$db = new mysqli("example.com", "user", "password", "database");
$query = 'SELECT * FROM users where name = ' . $username . ';';
$result = $mysqli->query($query);
echo json_encode($result->fetchAll());
?>
Raw
index.html
<html>
<h1>You requested product ID: <span id="productid"></span></h1>
<script>
$("#productid").innerHTML = decodeURIComponent(location.search.substr(5));
</script>
</html>
Raw
main.cpp
#include <stdio.h>
#include <string.h>
int main(void) {
char userinput[15];
int pass = 0;
printf("Enter password: \n");
gets(userinput);
if(strcmp(userinput, "h4x0r")) {
printf ("Access Denied! \n");
} else {
printf ("Access Granted! \n");
pass = 1;
}
if(pass) {
printf ("Secret sauce \n");
}
return 0;
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment