webPromedium
Lab 267 — RestForge — SQL Injection in Dynamic Data Endpoint
hackadvisor
Task: RestForge auto-generates REST endpoints from PostgreSQL; /api/data/:schema/:table has unsanitized table path parameter. Solution: UNION-based SQL injection with type casting to bypass application-level schema access control and extract flag from admin.internal_secrets table.
$ ls tags/ techniques/
jwt_authenticationinformation_schema_enumerationdecoy_flag_identificationunion_based_sql_injectionpostgresql_type_castingschema_access_control_bypass
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 273 — AuthForge — SSRF via OAuth Dynamic Client Registration— hackadvisor
- [web][Pro]Lab 114 — APIForge — JWT JKU Header Injection for Privilege Escalation— hackadvisor
- [web][Pro]Lab 298 — PayLedger — SQL Injection via GraphQL Date Filters— hackadvisor
- [web][Pro]Lab 103 — DataPilot — AI SQL Injection via Natural Language Query— hackadvisor
- [web][Pro]Lab 351 — FlowForge — RCE via Python Code Validation Endpoint— hackadvisor