https://cryptocat.me/blog/ctf/2022/nahamcon/web/flaskmetal_alchemist/
Blind SQL Injection via ORDER BY Logic | NahamCon CTF 2022: Flaskmetal Alchemist - CryptoCat's Blog
Flaskmetal Alchemist web writeup from NahamCon CTF 2022. Abuse a blind boolean SQL injection in an ORDER BY clause to exfiltrate the flag character by...