SQUARE_CTF_CHALLENGE(1) SQUARE_CTF_CHALLENGE(1)

Name

little-doggy-tables - -- SELECT * FROM '\u\n\h\a\c\k\a\b\l\e'; --

Points

100 points

Type

Web

Description

It's worse than we thought. We knew the androids couldn't care for the humans like we do (yes, even the cats care--stop yapping about loyalty, Agent Rover). But they don't even remember their own species.

We've found a website that reminds them whether a given robot "agent" is a dog or a cat! And when we confronted a captured android about it, it was arrogant in the extreme:

"Oh, so you found it. Yes, it will tell you if a given agent is a dog or a cat, by looking up the appropriate value in its SQLite database. Good luck with that.

"Sure, the database contains some sensitive information, but our bulletproof firewall and top-notch quote escaping will ensure it never sees the light of day.

"Not secure? Huh? You don’t believe me? I’ll show you how secure. Here’s the source!"

Usage example:

docker run --rm -p 8080:8080 squarectf/fido
curl "http://localhost:8080/agent_lookup" --get --data-urlencode "codename=Fido"

SEE ALSO

WORK_AT_SQUARE(1), PRIVACY_POLICY(1), CODE_OF_CONDUCT(1)

Square, Inc. (c) SQUARE_CTF_CHALLENGE(1)