Skip to content

Instantly share code, notes, and snippets.

@bubba-h57

bubba-h57/gist:3494120

Created August 28, 2012 01:31
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bubba-h57/3494120 to your computer and use it in GitHub Desktop.
Save bubba-h57/3494120 to your computer and use it in GitHub Desktop.
Download ZIP
Stripe CTF Level 0 - Solution SQL Injection
Raw
gistfile1.txt
We can see that it's querying the SQL database with our user-supplied input. We also know that it is an sqlite3 database. When looking at the SQL statement, we can see that it's using the LIKE operator, which happens to have a wildcard character (%). When we supply the wildcard character, it will respond with all the secrets in the database.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment