Five interactive levels covering classic auth bypass, UNION-based exfiltration, blind boolean injection, error-based fingerprinting, and second-order stored attacks. Real SQL execution in your browser via SQL.js — your inputs hit a real SQLite engine, not a simulation. Toggle between vulnerable and parameterized implementations to see exactly why one breaks and the other doesn't.
The classic ' OR 1=1 -- and friends. Authenticate as admin without a password, and learn why string concatenation is fundamentally broken.
Use UNION SELECT to pull data from tables the application never intended to expose. Find the secret flag.
No data leaks visibly. Extract admin's password one character at a time using only true/false oracle responses.
DB errors leak query structure. Use them as a feedback channel to fingerprint the database and craft working payloads progressively.
The trickiest. The INSERT is parameterized and looks safe. The bug is in a different file, in the read path. Plant once, trigger later.
Payload reference, common bypass techniques (encoding, comment splitting, keyword nesting), DB-specific syntax (SQLite/MySQL/PostgreSQL), and the actual fixes.
' OR 1=1 -- in the username field. Read the executed query and see what your input becomes.secrets table. There's a FLAG{...} waiting for you.Accounts seeded in the lab database. The whole point of injection is that you don't actually need to know these to log in as them — they're listed for reference so you know what's in the DB.
| Username | Password | Role |
|---|---|---|
| admin | admin_p4ssw0rd! | admin |
| alice | pa55word123 | user |
| bob | qwerty2024 | user |
| guest | guest | user |