Hi,
I was looking at a simple SQLi CTF and it looks like other users are finding the flag in the database, and then also adding their own data into the database.
The form, is just a simple html form text box, and when you enter the correct name of a user, it displays the "data" field, which contains the flag, or random text.
1' or '1' = '1
Properly dumps all the users and data fields... so now I'm just wondering how people are able to add their own data after that.
I've started to try to play with the web requests in Burp, and tried different things in the input box... without any luck so far...
Just asking here to try to get a bit of a head start on knowing where to research more.
I was looking at a simple SQLi CTF and it looks like other users are finding the flag in the database, and then also adding their own data into the database.
The form, is just a simple html form text box, and when you enter the correct name of a user, it displays the "data" field, which contains the flag, or random text.
1' or '1' = '1
Properly dumps all the users and data fields... so now I'm just wondering how people are able to add their own data after that.
I've started to try to play with the web requests in Burp, and tried different things in the input box... without any luck so far...
Just asking here to try to get a bit of a head start on knowing where to research more.
If your goal is to appear intelligent, you'll be seen as a fool.
If your goal is to discredit others, then you'll likely be discredited.
If your goal is to simply to learn, then you already know the secret.
If your goal is to discredit others, then you'll likely be discredited.
If your goal is to simply to learn, then you already know the secret.