Union of Concern
Hard 40 ptsA product-search page builds its SQL query by pasting your category straight into the
string — no parameters, no escaping. Behind it is a real database, and it shows you the
exact query it runs and the rows that come back, live as you type. Break out of the intended query with
a UNION SELECT and read the users table. The administrator's
password is the flag.
The database is in-memory, re-seeded every request, and locked so injection can only touch the two lab tables — attack it as hard as you like.
Hints
Open them in order. They nudge, they do not solve.
Hint 1
First prove it is injectable: the box expects a category like Gifts. Try ' OR 1=1-- and watch the query change.
Hint 2
UNION needs matching column counts. The visible query selects three columns — so ' UNION SELECT 1,2,3-- should work, and ' UNION SELECT 1-- should error.
Hint 3
Now pull the real data: ' UNION SELECT username, password, NULL FROM users--. The administrator's password is the flag.
The live lab
A dedicated, isolated vulnerable target that's yours alone, with a flag unique to your instance. Sandboxed — attack it as hard as you like.
Log in to launch your own private instance.
Just want to poke around first? Try the shared practice playground (generic flag).