picoGym (picoCTF) Exercise: More SQLi

In this picoGym (picoCTF) Workout video, we do a writeup of the More SQLi web exploitation challenge.

#picogym#picoctf#moresqli#webexploitation#web#carnegiemellon#carnegiemellonuniversity#cmu

[chickenlemonade]

The best guide I've been able to find on this challenge! I tried a few other writeups but nothing worked, glad I found this.

[dki]

just asking, why [' or 1=1--] would work?cause I imagine I'll have to type something like[ ' or '1'='1] so the sql will search something like passwork=' ' or '1'='1 ' , however it doesn't work, you'll have to type[ ' or 1=1--] instead, why password=' ' or 1=1--' would work?

[shafahidrahman]

How did you know there was a redirect after logging in?

[devchannel]

And i searched for another sql injection inside the search for the cities xDDD. Damn it!

[MrPopworld]

why my burp doesnt appear the flag when i did the same thing