RatCTF

🧪 Labs › Injection

SQL Injection

Severity: High
Illustration for SQL Injection

Make the database answer a question the application never meant to ask.

What it is

SQL injection happens when an application builds a database query by pasting your input straight into the query text. The database can't tell your data apart from the developer's instructions, so a value that contains SQL syntax is parsed as SQL.

The impact is broad: read any table the database account can see (users, password hashes, orders), bypass a login by making the WHERE clause always true, and on some engines read or write files or run commands.

The root cause is always the same — untrusted input was treated as code. The fix is always the same too: send the query and the data to the database separately, so the data can never be parsed as syntax.

How to approach it

  • Find an input that reaches a query — a login field, a search box, an id in the URL, a sort parameter.
  • Probe how your input is handled: does a single quote change the response or cause an error? Does the page behave differently for a condition that is true versus one that is false?
  • Once you can tell true from false, you can ask the database yes/no questions and read data out one answer at a time — even when the app never prints query results.
  • Map the structure (which tables and columns exist) before trying to read specific values.

Your task

Recover the credentials stored in the application's database and use them to log in as a privileged user.

▶ Access the lab

Opens your hosted RatCTF instance. Work on it directly — there's nothing to submit here; you'll know when you've solved it.

How to prevent it

  • Use parameterised queries (prepared statements) everywhere — never build SQL by string concatenation.
  • Give the application's database account the least privilege it needs.
  • Treat an ORM's raw-query escape hatch with the same caution as hand-written SQL.

More Injection labs

← All labs