> For the complete documentation index, see [llms.txt](https://simon-6.gitbook.io/simoncyber/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://simon-6.gitbook.io/simoncyber/ctf-writeups/picoctf-2022/web-exploitation/sql-direct.md).

# SQL Direct

<figure><img src="/files/t52xziVFXOYhTlpgp9yC" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/5NA1MpvLnMqMzNmunVZ0" alt=""><figcaption></figcaption></figure>

Once we connect to the PostgreSQL interface, we can learn some commands using the \\? commands. We can either use SQL or PostgreSQL commands for note.

<figure><img src="/files/PDR7gE0cToabWmhqlwW9" alt=""><figcaption></figcaption></figure>

If we scroll we can see \d, we can see one command that lists all the tables in the server&#x20;

<figure><img src="/files/HsbLARGhH6UqpxddRP3F" alt=""><figcaption></figcaption></figure>

Once we type \d we can see the flag.&#x20;

<figure><img src="/files/TtbpLQ0D1gKJ8Tn3gapo" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/AI9pV7Z7d8ePVwZE99DH" alt=""><figcaption></figcaption></figure>
