Tags: sqli check-in
Rating:
**Description**
> This platform is under protection. DO NOT hack it.
**No files provided**
**Solution**
This was the check-in challenge for this CTF, which usually means "look for the flag in the IRC channel". But in this case the flag was nowhere to be found, neither in the IRC nor in the rules, nor in the webpage comments.
My teammate heard that the advertisement is in some way related to CloudFlare, and the CTF website was indeed protected by CloudFlare. I spent some time looking for something interesting in the WHOIS information, or something related to CF status reports, but to no avail.
The very first thing I tried with this challenge was actually to input `" OR 1 == 1 -- ` as the flag, and doing this redirected me to a login page. I did not think much of it, but I was never logged off, and inputting a wrong flag in the other challenges did not redirect - it simply flashed a "Wrong flag" message.
After entering a wrong flag for a different challenge for the first time, I realised this and came back to this challenge. Once again I input the SQL injection and looked in the HTML comments in the login form, and the flag was there!
`rwctf{SafeLine_1s_watch1ng_uuu}`
Its a advertisement type of page. From that page i must tell you that you can think better for your <a href="https://www.assignmentgeek.com.au/">assignmentgeek.com.au</a>. That betterness is increase the passion to get work and from that work we can think about our future.
