Tag: commans

capture the flag, hacking, owasp, web application security

PicoCTF 2017 – My First SQL

thefluffy007

Another day, another challenge.

Today’s blog post we will be solving the challenge, “My First SQL” from the PicoCTF.

Let’s get started.

Going to the challenge we see:

PicoCTF_My_First_SQL_1

OK… we need to access a website, but we do not have the password. Let’s see what the hints give us.

PicoCTF_My_First_SQL_4

Clicking the website link we see:

PicoCTF_My_First_SQL_2

Doing a right click, view page source we see:

PicoCTF_My_First_SQL_3

We do not see anything useful. We have a form that is looking for a username and password.

Going back to the hints, let’s do a Google search of SQL Injection.

After doing the search we have a link, that specifies how to do a SQL injection to do login bypass.

Let’s do it.

Going back to the website, we see that we have a username and password.

Let’s try using a username of “admin”

and a password of ” ‘ OR ‘1’=’1′ ”

PicoCTF_My_First_SQL_5

Pressing login we get:

PicoCTF_My_First_SQL_6

We found the flag, and acquired 50 points!