OverTheWire Natas Level 13 -> Level 14 - Walkthrough

OverTheWire Natas Solution

Introduction

In this level, I'll give you a walkthrough to the natas wargame Level 13 -> Level 14. We will use SQL injection to get the password for the next level. 

Goal

Login to natas14 and get the password for the next level.

Login details

URL - http://natas14.natas.labs.overthewire.org
Username - natas14
Password - qPazSJBmrmU7UQJv17MHk1PGC4DxZMEP

Theory

SQL injection attack consists of injecting an SQL query via the input option available on the application. Successful attack can read sensitive data from the database and modify it. 

mysqli_num_rows() is a php function that is used to check whether data is present in the database or not.

mysqli_query() function performs a query on the database. It returns a successful mysqli_result object. The mysqli_result object is the input for the mysqli_num_rows() function.

Solution

Open the URL in a browser. Enter the username and password mentioned above.

On successful login, below screen appears which asks for username and password to proceed further.

Click on "View sourcecode".

We can see that the code connects to a MySQL database on the localhost and selects the natas14 database. Then it constructs and executes a query. Notice that if "debug" parameter is present in the GET request then the page will execute and display the sql query even if the username and password is incorrect.

We can pass the username, password and debug parameter through the URL and get some information. Type in the URL-:
http://natas14.natas.labs.overthewire.org/index.php?username=test&password=test&debug

This displays the query that is used to get the details from the database. We can modify the input accordingly and get the details.
We can enter "=" in place of the username and password which will make it a valid query and it will return all rows from the table "users". The query will look like-:
SELECT * from users where username = ""="" and password = ""=""
Therefore, enter "=" as username and password.

Click Login to get the password.

This completes the walkthrough for Level 14 as we have got the password. Please post your doubts and questions in the comment section.