SQL injection: blind extraction with time delays
The app runs a query on the `TrackingId` cookie but never shows the result or an error. Use conditional `SLEEP()` to read the admin password one character at a time.
Scenario
Every page sets a TrackingId cookie which the server looks up:
SELECT COUNT(*) FROM tracked_users WHERE tracking_id = '<cookie value>'
The result is never displayed and SQL errors are handled silently. The only observable you can influence is response time.
Your objective
Recover the administrator password from the users table using time-based inference, then log in. Solved when you reach the account page as the administrator.
Capture 2 flag(s) and record the exact technique for each step.
Getting started
- Inject
'-SLEEP(3)-'into theTrackingIdcookie and confirm a ~3 s delay. - Build a conditional:
' AND IF(1=1, SLEEP(3), 0)-- -(slow) vs1=2(fast). - Confirm the target row:
' AND (SELECT IF(COUNT(*)=1,SLEEP(3),0) FROM users WHERE username='administrator')-- -. - Binary-search each character with
SUBSTRING(password,<i>,1)andASCII(...) > <mid>. Script it. - Submit the password length and the password as the two flags.
Connecting
Press Launch Lab to build your own instance, then use the How to connect panel — it shows the browser link as soon as the app is running. Hit Stop when you are done, or Relaunch / Reset for a clean copy.
Credentials: Start unauthenticated — the tracking cookie is set on the home page.
Hints
Tip
Keep the sleep short and run one request at a time — the grader tolerates a slow solve but not a hammered server.
How to connect
Connect to the lab VPN first
Lab machines sit on an isolated network with no public address. Connect to the VPN once — the same config works for every lab.
1 · Get your config
Download rooted-labs.ovpn2 · Connect
Linux / macOS — from a terminal:
Windows / mobile — import the file into OpenVPN Connect, Tunnelblick, or the OpenVPN GUI.
3 · Reach the machine
Once connected, the address shown below (SSH command / lab link / RDP command) is reachable. Only lab traffic is routed through the VPN — your normal internet is untouched.
Step 2 — reach the machine
Open the lab in your browser:
Open labCredentials: Start unauthenticated — the tracking cookie is set on the home page.
The app can take a few more seconds to finish booting after the link appears.
Starting the container — your link will appear here automatically.
Launch the lab (sidebar) to get your link.
SSH into the machine:
Password for rabbit:
Log in as rabbit (has sudo). First login may take a few seconds while SSH finishes starting.
Provisioning — the SSH command will appear here when the machine is ready.
Launch the lab (sidebar) to get the SSH command.
Challenge questions
0 / 2 correct- Submit the initial flag you recovered while solving this lab.
- Which vulnerability class does this lab cover? (a few words)
On this page
Access
FREEAt a glance
- Operating system
- Web application
- Connection
- Browser / HTTP
- Questions
- 0 / 2 solved
- Launched by
- 0 hackers
- Maintained by
- Faustino Luettgen
Your machine
Status
Booting your machine — this takes about a minute. Connection details appear in the brief below when it's ready.
Ready — see How to connect below.
Provisioning failed. Hit Relaunch to try again.