Track A · Stage 2

1. In the host field enter 127.0.0.1; cat /flag.txt. Why: the app builds ping -c1 <input> and runs it in a shell. The ; ends the ping command and starts yours, so cat /flag.txt runs with the app's privileges.

2. Alternatives: 127.0.0.1 && cat /flag.txt or $(cat /flag.txt).

3. The command output (including the flag) is reflected back on the page.

Lesson: never pass user input to a shell; use argument arrays / libraries and strict allow-lists.

1. In the password field enter ' OR '1'='1. Why: the query is SELECT * FROM users WHERE user='admin' AND pass='<input>'. Your ' closes the password string, and OR '1'='1' makes the WHERE clause always true, so the password check is bypassed and the first row (admin) is returned.

2. Or use admin'-- in the username to comment out the password check.

3. On success the admin dashboard prints the flag.

Lesson: use parameterized queries / prepared statements.