> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2021/web-exploitation/web-gauntlet-2.md).

# Web Gauntlet 2

<figure><img src="/files/lgTGtsx9YhKKqKSkxmGg" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/4C7wxskOU5qhZfdA7v5n" alt=""><figcaption></figcaption></figure>

It filters "Filters: or and true false union like = > < ; -- /\* \*/ admin".&#x20;

### The Solution&#x20;

{% embed url="<https://sqlite.org/lang_expr.html>" %}

The payload is "`ad'||'min'%00`" How does it work?

* || is the operation for string concnation. ad'||'min' becomes admin.&#x20;
* %00 acts like a comment.  %00 is null byte that is URL-coded that terminates the string after it. Why does %00 work?&#x20;

### What is URL-Coded&#x20;

**URL encoding** is a way to represent special characters as `%XX` where XX is the hex code of the character. Since the %00 value represents 0, the C engine of SQLite stops reading it once it reaches it.&#x20;

Hence after this, the payload now becomes:

SELECT \* FROM users WHERE username = 'ad'||'min'%00. However, we can not type this in the query. We need to use curl to post it to the website. This is because in the browser, "%" encodes it to %25, not just %.&#x20;