> For the complete documentation index, see [llms.txt](https://ctf.zeyu2001.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ctf.zeyu2001.com/2021/csaw-ctf-qualification-round-2021/no-pass-needed.md).

# no pass needed

## Description

It's all about who you know and I know 'admin'.

<http://web.chal.csaw.io:5001>

## Solution

* The username is reflected back into the username field (its `value` attribute) after failed authentication
* By fuzzing username inputs, we can find that anything after a whitespace is removed.
* Furthermore, 'admin' is replaced **non-recursively**.

We can exploit an SQL injection in the username parameter. The payload is:

```
username=adadminmin';#&password=
```

This will translate to the query:

```
SELECT * FROM users WHERE username='admin';#
```

The flag is `flag{wh0_n3ed5_a_p4ssw0rd_anyw4y}`.