> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/sql-injection-sqli/shady-oaks-financial-shadyoaks-005.md).

# Shady Oaks Financial  - shadyoaks-005

Level: Easy\
Points: 10\
Type: Daily Challenge

Found SQLi in search feature

<figure><img src="/files/wbxzrzO670NofdK4Ooqg" alt=""><figcaption></figcaption></figure>

`' or 1=1— -`

<figure><img src="/files/RsyA6oleRh6nlgQFHpVU" alt=""><figcaption></figcaption></figure>

Using union method, we know number of column to be 8\
`' union select 1,2,3,4,5,6,7,8 -- -`<br>

<figure><img src="/files/GQZcEdcgxg3HlvT5R7Ae" alt=""><figcaption></figcaption></figure>

Use this resource to find database name, table name, column name and then dump everything that seems interesting [PayloadsAllTheThings SQLi Cheatsheet](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/SQL%20Injection#dbms-identification).\
Or visit checkout the solution of [Ottegram ](https://notes.dollarboysushil.com/web-application-pentest/bugforge/sql-injection-sqli/ottergram)for detail step.<br>

After finding necessary datas, we dump the username and password. Password of admin = flag of lab.

<figure><img src="/files/fm51qDoC2CTtuPJ2LAYl" alt=""><figcaption></figcaption></figure>