All challenges
Web
Staff Login
EasyWeb lab
A staff login page builds its SQL query by pasting your input straight into a string — the oldest mistake in the book.
Launch the lab, bypass the login, and read the admin's note. That note is your flag.
Classic payloads to try in the username field: admin'-- or ' OR '1'='1' --. You can also use UNION SELECT.
This challenge has a lab
The lab runs entirely in your browser and contains your own personal flag.
Sign in to launch the labSubmit the flag
Sign in or create an account to submit flags.
Hints
Unlocking a hint deducts its cost from your score.
- Hint 1· 40 points
- Hint 2· 60 points
Write-up
Solve the challenge to read how it works.