📊 Challenge Overview

Category	Details	Additional Info
🏆 Event	PicoGym	Event Link
🔰 Category	Web	🌐
💎 Points	500	Out of 500 total
⭐ Difficulty	🟡 Medium	Personal Rating: 0/10
👤 Author	madStacks	Profile
🎮 Solves (At the time of flag submission)	4.878	solve rate
📅 Date	21-02-2025	PicoGym
🦾 Solved By	mH4ck3r0n3	Team:

📝 Challenge Information

Last time, I promise! Only 25 characters this time. Log in as admin Site: http://mercury.picoctf.net:24143/ Filter: http://mercury.picoctf.net:24143/filter.php

🎯 Challenge Files & Infrastructure

Provided Files

1	Files: None

🔍 Initial Analysis

First Steps

Initially, the website appears as follows:

This is the third challenge in the Web Gauntlet series and is identical to Web Gauntlet 2 in terms of the applied filters. The only difference is that the payload length is reduced from 35 to 25 characters. However, I noticed that the payloads used for Web Gauntlet 2 do not exceed 25 characters, making them valid for this challenge as well.

1 2	username: ad'||'min password: ' IS NOT 'a

So I directly used the previous payload to achieve the injection and gain access as the admin user.

I won’t detail the exploitation phase since it was quite straightforward and identical to Web Gauntlet 2. For more information on why it works, refer directly to Web Gauntlet 2.

🔬 Vulnerability Analysis

Potential Vulnerabilities

• SQL Injection

🎯 Solution Path

Exploitation Steps

Flag capture

🛠️ Exploitation Process

Approach

The exploit is identical to the one used in the challenge Web Gauntlet 2, with the only difference being the challenge URL.

•  Exploit

🚩 Flag Capture

Flag

Proof of Execution

Screenshot of successful exploitation

🔧 Tools Used

Tool	Purpose
Python	Exploit

💡 Key Learnings

Skills Improved

• Binary Exploitation
• Reverse Engineering
• Web Exploitation
• Cryptography
• Forensics
• OSINT
• Miscellaneous

📚 References & Resources

Similar Challenges

• Web Gauntlet 2

Learning Resources

• https://www.sqlitetutorial.net/

📊 Final Statistics

Created: 21-02-2025 • Last Modified: 21-02-2025 *Author: mH4ck3r0n3 • Team: *