Prisma Blogs
This is challenge prisma type ORM database. Target is a API, have two api, /api/posts and /api/all. Let’ go!!!! I. Recon
Create DB Challenge have code by Nodejs, focus index.js, seed.js. You can see, challenge use file schema.prisma to create DB, before use typeORM prisma to query. Prisma is a typeORM, you can build database by prisma:
Install Prisma CLI : npm install prisma --save-dev
Install driver SQLite ( vì challenge dùng SQLite) : npm install @prisma/client
Run file schema.prisma to build : npx prisma db push
Function: a. seed.js You can see seed.js, it’s create record of users and posts. There are two points to note:
In this file, you can that the flag is located in the Posts table, but the Flag has the published attribute set to false.
Each user will random password, and each user will be the author of a random post (the post itself is also generated randomly). So, if want to read all posts, you should have all users. b. index.js Server is running on http://localhost:${PORT} File index.js handle two endpoint is two API":
/api/posts will receive a variable query, before the attribute to set published = true. So the flag not read because attribute to set published = true.
/api/login, if you have user and password. You can login, and read all post of user. II. Analysis The path I think is to somehow obtain the passwords of the accounts. Howerer, bruce force is impossible because thet are generated using this functions generateString() The number of possible casses is enormous. However, you can see /api/post, parameter query can inserted directly, it’s inserted dircetly in query. We can think SQLi, but prisma filltered SQLi so exploiting SQLi is very unlikely to occur. Foucs model Post, you can see in model Post have atribute author, it’s relation of model User.\n Therefore, we can query using atribute author. Example:\n We can query using name, password, howerver atributed published is set true, so the flag is not view. At this point, there is way to solve this problem. Bruce force or anything, impossbile. Before search, i know prisma have atribute gte (greater than or equal to) or lt (less than). It’s can way to solve this problem. Here, i have set up a localhost and create a database. I will demonstrate it for you. I have also written an endpoint /api/all to display all user. You can see, the password of White is “6nO7H…“. Now, I can query using author[name]=White, and author[password][gte]=1. Because gte is greater than or equal to so, result query OK, return record is all Posts of White ( published is true) because 6>1 is True. Howere, if query author[name]=White, and author[password][gte]=7. result query [] because 6>7 is False Bsed on the differences of two request, we bruce force password of users. III. POC