A search box that returned the users table
The shop’s search API logged a run of quotes, ORDER BY probes, and UNION SELECTs. Identify the parameter, the table that was dumped, and the size of the response that leaked it.
Briefing
The search API on shop-api-02 normally returns a couple of kilobytes. One response this morning was close to 190 KB.
SQL injection leaves a recognizable trail: a single quote that causes a 500, ORDER BY to count columns, then UNION SELECT to read other tables. The payload is URL-encoded, so a space appears as %20 and a quote as %27.
shop-api-02 · Web server logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.