The Purple Pages [SQLI login bypass]
Writeup for EPT CTF- The Purple Pages (I will never get tired of DALLES fantastic way of spelling things...)
11/12/20231 min read
This was a fairly simple task. Considering we were given no hint with a username, any password hint, and when gobusting the room only leads us to a page we are unauthenticated to visit, I quickly realized that this must be some sort of SQLI room.
Flag'o clock!
I was lazy, so I went to hacktricks and found a couple og injections syntaxes I wanted to try out. My first goal was to make an error happen, just to confirm that it is in fact SQLI that is the vulnerability.
login all together. I remembered that commenting out the password part is an effective way of just focusing on the username part of the login. So I crafted this syntax. “' OR '1'='1' -- ” (Note that the space behind the “—” is very important to actually comment out the password section.
I tried it out and BAM! The flag is ours!
