webProeasy
Lab 81 — InsightPulse — SQL Injection in Analytics Tracking
hackadvisor
Task: InsightPulse web analytics dashboard with /api/track endpoint that stores visitor User-Agent header directly into SQLite via string concatenation in INSERT statement. Solution: Stored SQL injection via User-Agent header using subquery injection to enumerate sqlite_master, discover platform_secrets table, and extract the flag.
$ ls tags/ techniques/
sqlitesqlisql_injectionnodejsheader_injectionuser_agenthoneypotdecoy_flaganalyticsexpress_jstracking_pixelstored_sqli
sqlite_master_enumerationdecoy_flag_identificationstored_sql_injection_via_user_agent_headersubquery_injection_in_insertpragma_table_infotracking_pixel_abuse
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 322 — NetPulse — IP Spoofing to RCE via Polling Agent API— hackadvisor
- [web][Pro]Lab 53 — TeamPulse — SQL Injection via WebSocket Employee Lookup— hackadvisor
- [web][Pro]Lab 120 — InfraPulse— hackadvisor
- [web][Pro]Lab 326 — PulseBoard — NoSQL Injection in Authentication— hackadvisor
- [web][Pro]Lab 59 — NetPulse — RCE via Command Injection in Network Diagnostics— hackadvisor