Irish-Name-Repo 2 picoCTF 2019 Solution

Description

1. Step 1Identify the login form and turn on debug

   Observation

   The description says to log in as admin on a new version of the Irish-Name-Repo site. So the login form is the attack surface, and the hidden debug parameter is worth enabling to see what the server is doing.

   Navigate to the challenge URL. There is a login form asking for username and password, and a hidden debug parameter. Set debug=1 (edit the form in dev tools or add it to the POST body) so the server echoes the exact SQL query it builds. IR-2 also filters the obvious OR-based payloads, which is why a comment-based bypass is used below rather than ' OR 1=1.

   What didn't work first

   Tried: Attempting ' OR 1=1-- or OR-based payloads immediately without enabling debug mode.

   Without debug=1 you get a generic error or failed login with no query echo, so you cannot tell whether the filter caught your payload or the syntax was simply wrong. Turning debug on first shows the exact query the server builds, which makes the target obvious.

   Tried: Looking for the debug parameter in the page's visible HTML source using View Source instead of DevTools.

   View Source shows the raw HTML the server sent, before any JavaScript runs, so hidden fields added or changed by client-side scripts never appear there. The Elements panel shows the live DOM including every hidden input, which makes the debug field easy to find and edit.

   Learn more

   SQL injection occurs when user-supplied input is embedded directly into a SQL query without proper sanitization. A classic login query looks like: SELECT * FROM users WHERE username='INPUT' AND password='PASS'.

   If INPUT is controlled by the attacker, inserting a single quote can break out of the string literal and change the query's logic.

2. Step 2Use a SQL injection bypass payload

   Observation

   The debug output shows the server filtering OR-based payloads. A comment-based bypass like admin'-- avoids OR entirely: it closes the username string and throws away the password check.

   Enter admin'-- as the username and anything as the password. The double dash comments out the rest of the SQL query, so the password check is skipped entirely.

   What didn't work first

   Tried: Trying ' OR '1'='1 or ' OR 1=1-- as the username payload.

   IR-2 filters OR-based payloads server-side, so those come back as a failure or a filtered query in the debug output. The comment approach (admin'--) never uses OR at all: it closes the username string and discards the rest with a comment, slipping past the filter.

   Tried: Omitting the trailing space after - or forgetting the double dash entirely and using # as the comment character.

   MySQL accepts # as a comment delimiter, but the database here uses a dialect that needs --. Some parsers also require a space after - before they treat it as a comment. If the payload does not produce the query you expect, check the comment syntax against what the debug echo shows.

   Learn more

   The payload admin'-- transforms the query into: SELECT * FROM users WHERE username='admin'--' AND password='...'. Everything after -- is a comment in SQL, so the password condition is never evaluated.

   Alternatively, ' OR 1=1-- makes the WHERE clause always true, returning all rows and logging you in as the first user in the database (often admin).

   Modern applications prevent this with parameterized queries (prepared statements), which treat user input purely as data, never as SQL syntax.

3. Step 3Retrieve the flag

   Observation

   The login succeeds and the server redirects to an authenticated page, so the bypass worked. The flag should be right there in the post-login content.

   After successful login, the page displays the flag. Copy it.

   Learn more

   SQL injection has been in the OWASP Top 10 most critical web security risks for over a decade. Despite being well-understood, it remains common because developers sometimes build queries with string concatenation rather than parameterization.

Flag

IR-2 adds a SQLi filter that blocks OR-based payloads and a debug=1 param that echoes the query. Use admin'-- as the username to comment out the password check. The flag's hex suffix is instance-specific.