Need to find the first name of 'Chan'. `2`  It's a ping command? Command injection?  Command injection it is `test; sqlite3` `.open onboard.db` `.dump`  Instead of fishing through all of the data, let's do it an easier way `select sql from sqlite_master;`  We now know that the column containing last names is named 'lname' `select * from onboard where lname = 'Chan'`  Looks like his first name is Scott Let's go back to the start and run the 'runtoanswer' program  --- Back to [[_WebSite Publish/CTF/CTF Index|CTF Index]] Tags: #ctf #sql #command_injection Related: