Google CTF 2016 – Little Bobby application

				
					public class LocalDatabaseHelper extends SQLiteOpenHelper {  
    private static final String COMMA_SEP = ",";  
    public static final String DATABASE_NAME = "LocalDatabase.db";  
    public static final int DATABASE_VERSION = 1;  
    private static final String SQL_CREATE_ENTRIES = "CREATE TABLE users (_id INTEGER PRIMARY KEY,username TEXT,password TEXT,flag TEXT,salt TEXT)";  
    private static final String SQL_DELETE_ENTRIES = "DROP TABLE IF EXISTS users";  
    private static final String TEXT_TYPE = " TEXT";  
  
    public LocalDatabaseHelper(Context context) {  
        super(context, DATABASE_NAME, (SQLiteDatabase.CursorFactory) null, 1);  
    }  
  
    @Override // android.database.sqlite.SQLiteOpenHelper  
    public void onCreate(SQLiteDatabase db) {  
        db.execSQL(SQL_CREATE_ENTRIES);  
    }  
  
    @Override // android.database.sqlite.SQLiteOpenHelper  
    public void onUpgrade(SQLiteDatabase db, int oldVersion, int newVersion) {  
        db.execSQL(SQL_DELETE_ENTRIES);  
        onCreate(db);  
    }  
  
    @Override // android.database.sqlite.SQLiteOpenHelper  
    public void onDowngrade(SQLiteDatabase db, int oldVersion, int newVersion) {  
        onUpgrade(db, oldVersion, newVersion);  
    }  
  
    public long insert(String username, String password) {  
        Random rand = new Random();  
        int salt = rand.nextInt(31337);  
        String password_hash = Utils.calcHash(password + new Integer(salt).toString());  
        SQLiteDatabase db = getWritableDatabase();  
        ContentValues values = new ContentValues();  
        values.put(LocalDatabase.UserEntry.COLUMN_NAME_USERNAME, username);  
        values.put(LocalDatabase.UserEntry.COLUMN_NAME_PASSWORD, password_hash);  
        values.put(LocalDatabase.UserEntry.COLUMN_NAME_FLAG, "ctf{An injection is all you need to get this flag - " + password_hash + "}");  
        values.put(LocalDatabase.UserEntry.COLUMN_NAME_SALT, new Integer(salt).toString());  
        long rowId = db.insert(LocalDatabase.UserEntry.TABLE_NAME, null, values);  
        db.close();  
        return rowId;  
    }  
  
    public String[] fetch(String username) {  
        SQLiteDatabase db = getReadableDatabase();  
        Cursor c = db.rawQuery("select username, password, salt from users where username = \"" + username + "\"", null);  
        c.moveToFirst();  
        String[] output = {c.getString(0), c.getString(1), c.getString(2)};  
        c.close();  
        db.close();  
        return output;  
    }  
  
    public String checkLogin(String username, String password) {  
        SQLiteDatabase db = getReadableDatabase();  
        Cursor c = db.rawQuery("select password,salt from users where username = \"" + username + "\"", null);  
        Log.d("Username", username);  
        if (c != null && c.getCount() > 0) {  
            c.moveToFirst();  
            String testPassword = c.getString(0);  
            String testSalt = c.getString(1);  
            c.close();  
            db.close();  
            if (Utils.calcHash(password + testSalt).equals(testPassword)) {  
                Log.d("Result", "Logged in");  
                return "Logged in";  
            }  
            Log.d("Result", "Incorrect password");  
            return "Incorrect password";  
        }  
        if (c != null) {  
            c.close();  
        }  
        db.close();  
        Log.d("Result", "User does not exist");  
        return "User does not exist";  
    }  
  
    public boolean checkUser(String username) {  
        SQLiteDatabase db = getReadableDatabase();  
        Cursor c = db.rawQuery("select username from users where username = \"" + username + "\"", null);  
        Boolean b = new Boolean(c != null && c.getCount() > 0);  
        if (c != null) {  
            c.close();  
        }  
        db.close();  
        Log.d("Does User exist", b.toString());  
        return b.booleanValue();  
    }  
}