webProhard
Nova Arts
hackerlab
Task: exploit a Flask web app with a TrackingId cookie vulnerable to blind SQL injection against SQLite. Solution: use CASE WHEN with LOAD_EXTENSION as error oracle (X-Theme header change), binary search extraction of admin credentials via cookie injection, then login to /admin.
$ ls tags/ techniques/
binary_search_extractionblind_sqli_cookiesqlite_load_extension_oracleparallel_extraction
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Dosie X (Dossier X)— hackerlab
- [web][Pro]Bug Bounty-code— hackerlab
- [web][Pro]Печеньки с молочком (Cookies with Milk)— duckerz
- [web][Pro]Art is an explosion (Искусство — это взрыв)— duckerz
- [web][Pro]board_of_secrets— miptctf