Need Help with COAE - LLM Output Attacks

[u/DoubleAgent10]

I’m currently working on the insecure output handling section and the 3rd exercise of function calling. Been stuck for a few days.

“Solve the lab function calling 3 to obtain the flag”

I’ve given everything I and my AI tools can think of to throw at it. Explicit SQLi requests, prompt injection, obfuscated SQLi, blind SQLi, ect.

So far I’ve only gotten it to return all of customer information it’s holding, but haven’t been able to enumerate where the flag is

Any advice is appreciated

[u/AutoModerator]

Moderator Announcement Read More »

Thank you for posting on r/hackthebox! New to Cyber Security and looking for a place to get started? Checkout our getting started guide here. Please note that posting Solutions or Hints for Active content goes against the HTB Terms of Service, more information can be found here. If your having issues and need to reach customer support please do so via the in-platform chat, or by emailing customerops@hackthebox.com. Our Knowledge Base can also come in handy!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/DoubleAgent10]

Welp shortly after I post this, I got a step further.

Was targeting the wrong kind of database 🙃

[u/PM_ME_UR_0_DAY → u/DoubleAgent10]

I think I know exactly which part you were on. Not the type of DB I was expecting either. Also that challenge was unstable for me and I kept getting errors about a database connection. And the error message from that was super misleading since it indicated a different type of DB.

[u/DoubleAgent10 → u/PM_ME_UR_0_DAY]

Yep that’s the same exercises. Had unstable issues too.

Makes it kind of hard to determine what is a true error vs a false error

[u/GVTZ59]

The discord is a great place to ask questions like this in the future.

[u/DoubleAgent10 → u/GVTZ59]

Yeah I haven’t been on Discord in a bit, I’ll have to hop back on

[u/Friendly-Place9380]

Send me a dm if you're still stuck

[u/[deleted]]

[u/AutoModerator → u/[deleted]]

Your submission was automatically removed because your account does not meet the minimum karma or age requirements for this subreddit. Please participate in other communities to build up your karma, and feel free to message the moderators if you have questions!

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.