sanitize

Platform: HackTheBox | Category: Web | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Can you escape the query context and log in as admin at my super secure login page?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, open the host given.

2. Based from the html title, let's try to inject simple Sqli payload.

3. Input the username as admin'-- and the password as admin'--.

4. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.