webPromedium
Lab 83 — DealStream — UNION SQL Injection in Public Search API
hackadvisor
Task: CRM platform with public search API where the scope parameter is directly interpolated into a SQLite WHERE clause. Flag is XOR-encrypted in admin_settings, decrypted only in admin panel. Solution: UNION-based SQLi to enumerate schema and extract admin reset token, then account takeover via password reset to access admin panel and view decrypted flag.
$ ls tags/ techniques/
sqlitesqliflasknginxadmin_takeoverpassword_resetdecoy_flagxor_encryptionunion_sqlitoken_theftsearch_api
union_based_sqlisqlite_schema_enumerationapi_parameter_injectionpassword_reset_token_extractionaccount_takeover
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 79 — LeadStream — Blind SQL Injection via Excel Bulk Import— hackadvisor
- [web][Pro]Lab 3 — DeskFlow — SQL Injection in Ticket View— hackadvisor
- [web][Pro]Lab 203 — PlanFlow — SQL Injection in Team Directory Search— hackadvisor
- [web][Pro]Lab 373 — PipelineIQ — Django ORM Filter Injection— hackadvisor
- [web][Pro]Lab 103 — DataPilot — AI SQL Injection via Natural Language Query— hackadvisor