Web - Unholy Union
Last updated
Last updated
On the outskirts of a forsaken town lies an abandoned warehouse, rumored to store more than just forgotten relics. Locals speak of an unholy union within its database, where spectral data intertwines with the realm of the living. Whispers tell of a cursed ledger that merges forbidden entries through mysterious queries. Some say that the warehouse's inventory system responds to those who know how to merge the right requests. Can you brave the haunted inventory system and unravel the ghostly union of data before the spirits corrupt the world beyond?
The challenge name and the query itself says this can be solved through SQL Union Injection
First we can search with a
to see the table description (a space will match all characters since it's using SQL LIKE
operator)
so it's int,str,str,str,date
Result:
Result
Our interest lies in halloween_invetory
database
Result:
So there are 2 tables, flag and inventory
Let's get our flag....
Result:
We have 1 column named flag......
HTB{uN10n_1nj3ct10n_4r3_345y_t0_l34rn_r1gh17?_9c967dbf96425dc2df3b06135f0d003d}
___________________heapbytes' still pwning