Thread by @mcipekci

Few months ago @osiryszzz and me discovered an interesting case of SQL injection on the @SynackRedTeam target which was black box testing.

During recon we noticed that there was an unrestricted file upload mechanism available to the any user. #bugbounty #bugbountytips /1

We noticed that the target was only processing the ZIP files but where the content unzipped wasn't clear which was preventing potential RCE or file overwrite via ZIP bombing. /2

However it appears that each file entry inside the ZIP file was added to the database after unpacking, which we wanted to see if it's possible to achieve SQL injection, by simply making file name with SQL injection payload. /3

We confirmed that it was vulnerable to the time based SQL injection but how we were going to exploit it was in the question.

I made a simple middleware proxy like PHP script such as gist.github.com/mcipekci/29eb8… we were able to exploit the issue. /4

We forced SQLmap to send requests to the our script hosted on C2 instance which is processing payload and sending data to the actual target.

Which was very unique case of the SQL injection and was fun to exploit. /5

I hope this gives inspiration about going deeper and exploring beyond what's visible and creating your own unique techniques and solutions for cases.