+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43)
+----- Forum: SQL Injection Attacks (https://hackforums.net/forumdisplay.php?fid=103)
+----- Thread: inserting data using SQLi? (/showthread.php?tid=5614577)
inserting data using SQLi? - 13uNkNoWn - May 3, 2017
Hi,
I was looking at a simple SQLi CTF and it looks like other users are finding the flag in the database, and then also adding their own data into the database.
The form, is just a simple html form text box, and when you enter the correct name of a user, it displays the "data" field, which contains the flag, or random text.
1' or '1' = '1
Properly dumps all the users and data fields... so now I'm just wondering how people are able to add their own data after that.
I've started to try to play with the web requests in Burp, and tried different things in the input box... without any luck so far...
Just asking here to try to get a bit of a head start on knowing where to research more.