| Event | Title | Category | Cost |
|---|---|---|---|
| HSCTF 6 | S-Q-L | WEB | ~100 |
Written by: dwang
Keith keeps trying to keep his flag safe. This time, he used a database and some PHP.
On the page we see the authorization form.
From the name of the task, we understand that the SQL database is used.
We apply the simplest SQL-injection.
login: ' or 1=1 -- 123
password: any
hsctf{mysql_real_escape_string}