Challenge

A login gated app. The login fell to a classic SQLi:

admin'#  :  anything

Approach

Past the login, directory brute forcing turned up a spread of interesting paths (/uploads, /admin, /secrets, /hidden, /logs, /script, /cookie). We pulled database connection details (admin / securepassword123) and a sensitive_data.csv. A riddle in the app pointed at the final step: encode three recovered values and combine them into a PDF to produce the flag. This was a bit tedious, but we ended up getting it!