webProeasy
MetricFlow
hackadvisor
Task: Business analytics platform with Report Builder that passes metric alias names directly into Django ORM annotate() calls, placing them in double-quoted SQL identifiers. Solution: Inject double quote in alias to break out of identifier context, add subquery to SELECT clause to enumerate sqlite_master and extract flag from admin_secrets table.
$ ls tags/ techniques/
sqlitesql_injectionnodejsdjangoexpressblind_sqliboolean_baseddecoy_flaganalyticsorm_injectionevent_filterannotation_injectionreport_builder
binary_search_extractionsqlite_schema_enumerationboolean_based_blind_sqlidecoy_flag_avoidanceevent_filter_injectiondjango_orm_annotation_alias_injectionsubquery_injection_via_alias_breakout
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]MetricFlow— hackadvisor
- [web][Pro]MetricFlow — DOM XSS via Prototype Pollution Gadget— hackadvisor
- [web][Pro]Lab 168 — MetricFlow — Insecure Deserialization via Dashboard Import— hackadvisor
- [web][Pro]Lab 3 — DeskFlow — SQL Injection in Ticket View— hackadvisor
- [web][Pro]Lab 112 — MetricFlow — IDOR in Usage Analytics API— hackadvisor