# Second Breakfast

### **Challenge Overview**

This challenge consists of analyzing `init.sql` and `app.py` from the source code we're given.

`init.sql`:

```sql
CREATE TABLE flags (
    flag TEXT
);
```

We have some endpoints in `app.py` like `/login` and `/register` which seems to be well-secured using `%s`.\
But in `/profile` route we can clearly spot **SQL Injection**:

```python
query = f"SELECT username, created_at FROM users WHERE username='{username}'"
```

Since we got this in `/profile` endpoint, we can assume that this is not a classic SQLI injected in `/login` or `/register` path, but in our account username.

***

### **Exploitation**

> Note: This is not a blind SQLi since we have the source code and can see that the query returns 2 columns (`username` and `created_at`). Otherwise, we could use `ORDER BY 1`, `ORDER BY 2`, etc., to guess the number of columns.

The solution is to use an **UNION based attack**, which combines two or more `SELECT` queries.\
Because the original query has `USERNAME` (txt) and `created_at` (timestamp) we should create another one based on that.

After a Google Search I found `CURRENT_TIMESTAMP()` MYSQL Function. We could also use whatever timestamp we want in MySQL Format.

***

### **Final Payload**

```sql
' UNION SELECT flag, CURRENT_TIMESTAMP() FROM flags -- -
```

*made by k0d*
