PicoCTF SQL Direct Writeup: Querying PostgreSQL for the Flag Table

SQL Direct is a picoCTF 2022 challenge about interacting with a PostgreSQL database directly. The core idea is simple: once connected to the database, enumerate user-created tables, identify the table that stores the flag, and query it.

Challenge Overview

The prompt asks us to connect to a PostgreSQL server and find the flag. Since this is direct database access, the first useful step is not exploitation but database discovery.

Enumerating Tables

I queried PostgreSQL's information_schema.tables view to list non-system base tables:

SELECT table_schema, table_name
FROM information_schema.tables
WHERE table_type = 'BASE TABLE'
  AND table_schema NOT IN ('pg_catalog', 'information_schema');

The output showed a table under the public schema that looked relevant.

Extracting the Flag

With the table name identified, the final step was to query it directly:

SELECT * FROM public.flags;

Key Takeaways

1. PostgreSQL metadata views are useful for quickly separating system tables from challenge-created tables.
2. information_schema.tables is a portable first stop for table discovery.
3. Not every database challenge needs payload construction; sometimes the solve is clean enumeration and direct querying.

Final Thoughts

SQL Direct is a good reminder that database fluency matters. Knowing where metadata lives often turns a vague prompt into a short, structured solve.