webeasy

Login

spbctf

Task: extract a flag from a login form with boolean-based blind SQL injection (yes/no oracle). Solution: inject conditional SQL via the username field, use ASCII(SUBSTRING()) with binary search to extract the flag character by character.

$ ls tags/ techniques/
sqliblind_sqliboolean_basedlogin_bypass
binary_search_extractionboolean_based_blind_sqli
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]