HTB Cobblestone Stored XSS and Second-Order UNION SQL Inject...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://0xdf.gitlab.io/2026/08/15/htb-cobblestone.html
• Blog Title: HTB Cobblestone: Stored XSS and Second-Order UNION SQL Injection
• Suggested Section: Pentesting Web > SQL Injection > SQLMap - CheatSheet > Second Order Injection - SQLMap, with a cross-reference under XSS for exploiting stored XSS when session cookies are HttpOnly

🎯 Content Summary

Overview

Cobblestone is an Insane-rated Debian 12 Hack The Box target exposing several Minecraft-themed PHP applications through virtual hosts. The supplied section covers reconnaissance and the initial web compromise: username enumeration, an administrator-bot browsing primitive, stored cross-site scripting, sequential-ID IDOR, PHP numeric-string coercion, and an authenticated second-order UNION SQL injection in vote.cobblestone.htb. The SQL injection allows a low-privil...

🔧 Technical Details

Second-order SQL injection discovery: Trace attacker-controlled values after storage, not only at the endpoint that initially receives them. A value may be inserted safely but later read from the database and concatenated into another SQL statement. Submit an unmatched quote, then visit every page that consumes the stored record. If insertion succeeds but a later page crashes or truncates at the point where the value is processed, investigate a delayed SQL injection. In this case, storing 0xdf' caused the later details page to terminate while the record remained visible elsewhere.

UNION column and reflection discovery: Repair the malformed second-stage query by appending UNION probes with increasing column counts. A mismatch continues to fail, while a compatible query renders successfully. Here, three columns failed and ' UNION SELECT 1,2,3,4,5;-- - succeeded, proving a five-column query. Replace numeric markers with ...

🤖 Agent Actions

Updated:

src/pentesting-web/sql-injection/sqlmap/second-order-injection-sqlmap.md

Added:

• Delayed SQLi sink discovery using stored unmatched delimiters.
• Manual second-stage UNION column/reflection confirmation.
• sqlmap automation when a storage POST redirects dynamically to the execution page.
• Correct redirect handling: follow the redirect without resending POST data.
• Numbered citation to the Cobblestone write-up.

No XSS addition was needed because HackTricks already documents HttpOnly cookie leakage through same-origin response bodies, including phpinfo(). Validation passed with a clean git diff --check; only one file changed.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://0xdf.gitlab.io/2026/08/15/htb-cobblestone.html

Content Categories: Based on the analysis, this content was categorized under "Pentesting Web > SQL Injection > SQLMap - CheatSheet > Second Order Injection - SQLMap, with a cross-reference under XSS for exploiting stored XSS when session cookies are HttpOnly".

Repository Maintenance:

• MD Files Formatting: 989 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0