Skip to content

Instantly share code, notes, and snippets.

@sdamashek

sdamashek/SQL: The Sequel.md

Created May 15, 2016 15:40
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save sdamashek/a55d03d576f3a4bf7d4336a73e27c49a to your computer and use it in GitHub Desktop.
Save sdamashek/a55d03d576f3a4bf7d4336a73e27c49a to your computer and use it in GitHub Desktop.
Download ZIP
TJ CSL Writeup for SQL: The Sequel (PACTF 2016)
Raw
SQL: The Sequel.md

SQL: The Sequel

This problem was pretty simple - even though uname and pswd were filtered through mysql_real_escape_string(), the NO_BACKSLASH_ESCAPES option essentially negated that protection.

So to ignore the password field, use the username admin";# and you'll get the flag: Your flag is: bobby_tables_little

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment