RowdyHacks XII: world is mine

Challenge

Web · 150 points. A live forum is provided, and the flag lives on a staff-only page.

Recon

The forum's own posts are the clue trail. An announcement names the staff account miku_mod. A retired-login note gives an old password that "no longer works." A community post mentions that a quote character in the staff username produces a different error and that the database query "is being investigated." Together these point squarely at SQL injection in the username field of the login form.

Solution

The site issues a CSRF token on GET /login, so the request has to be session-aware: fetch the token first, then submit the injection. Supplying the username miku_mod'-- with any non-empty password behaves exactly as if the quote closes the username string and -- comments out the password check:

username = miku_mod'--
password = anything

The server authenticates the session and redirects to /staff, whose event handoff section displays the flag.

Takeaway

Unauthenticated SQL injection in a login field is the highest-stakes place the bug can appear, because it is a direct path to account takeover, and the different errors for a bad quote versus a bad password leaked that the input reached the query. Parameterized statements remove it, uniform error responses kill the oracle, and injection patterns in request logs are a clean detection.

Flag

rowdy{v1rtu4a1_1d0l}