Support thread for DevQuest contest

huh? I abswered a phone, but no one responded... In other words, I have no idea what to do. I see a question which implies a yes or no answer, but that ain;t the answer? I ain't got time for foolishness. Count me out.

@Arkie,

"sources" <-> "view page source". Check the first useful link in "What if need help?" section in the blog post.

Stuck on 7 :(

I'm stuck on 8 and I wish I could help you with 7. I'm only stuck on 8, as I keep getting a cloudflare Error 524.

You
Browser
Working

Chicago
Cloudflare
Working

xlinesoft.com
Host
Error

Now I have this:

HTTP Error 500.0 - Internal Server Error
The FastCGI process has failed frequently recently. Try the request again in a while

Congratulations to all who made it that far. The website is operational at the moment, probably was overloaded a bit.

It was very funny, thanks all the team of Xlinesoft !!!

Yep, Up to 8 now

Step 1 hint

"Source" = page source.

See anything interesting there, at the very beginning?

Step 2 hint

"consolation" = "console"

Press F12 to open Developer Tools. See anything console-ish there?

That was good. Lernt a bit from that also :)

Welp, I tried everything I could think of for 8. Can't figure out how to escape the like clause to make a new statement. This is why I'm a professiona amateur. lol. I was on a roll with 1-7 too.

@david22585,

not bad for an amateur!

With SQL injection I can suggest an approach like this. First of all, it prints the current SQL where your input is highlighted. Right down the SQL that you start with, when you just enter war. Then try to write down you ideal SQL query that you think will produce the results you need. Write them both down next to each other and this will give you an idea what you need to use instead of war. If nothing helps - post both queries here and we'll provide more tips.

SQL injection is not something that you normally need to deal with on this level but it is a sort of a fun exercise.

@admin

I tried. I've built a huge program using PHPRunner and learned a lot. While what we use is internal, I never knew about SQL injection until recently, and am now in the process of changing everything over to DB API PrepareSQL.

But here is what I got:

Original query:
SELECT * from books where owner='Mike' and bookname like '%war%'

What I want it to look like:
SELECT * from books where owner='Mike' and bookname like '%war%' OR owner='Pete'

Since it doesn't work, I will provide what I put into the answer, which only gives me blank results. I wil remove it if you want it taken off:
%" OR owner="Pete"--;
Produces:
SQL: SELECT * from books where owner='Mike' and bookname like '%%" OR owner="Pete"--;%'

I will highlight the input part of the initial query:

SELECT * from books where owner='Mike' and bookname like '%war%'

So, you are thinking in the direction and the following query would work, but ...
SELECT * from books where owner='Mike' and bookname like '%war%' OR owner='Pete'

The problem is that %' will be added to any input string and you won't be able to make the query end with owner='Pete'. No matter what, it will end with %'. But, you can use other comparison operators as like. You can see how it works studying the original query. % is a wildcard character in like WHERE clause. So you should be aiming for your query to end with something like this:
OR owner like 'Pet%'

I hope it makes sense.

@admin

That does make sense! Got it, and thanks for the fun!

On 8 I didnt use a query like that, Sorry wil DM admin :)