Irish-Name-Repo 2 (Medium)

  • Challenge Link: https://play.picoctf.org/practice/challenge/59?category=1&difficulty=2&page=4
  • Challenge Description: Someone has bypassed the login before, and now it's being strengthened. Try to see if you can still login!
  • Hints:
    1. The password is being filtered

Solution

Trying the same thing that we did with Irish Repo 1, using an classic SQLi, does not work anymore because now the site has defenses against SQLi.

' or 1 or '
Basic SQLi

So we can try another SQLi strategy which needs us to have a user that's actually valid in the query. We can try admin since it's a common mistake for people to name their users admin without changing it. The password can be anything since it is being commented out.

admin'--
user: admin
' → close
-- → comment everything else
Alt SQLi

We can get our flag:

picoCTF{m0R3_SQL_plz_8c334129}

Sources