https://th3b0ywh0l1v3d.github.io/tags/order-by-injection/ Recent content in Order-by-Injection on Th3B0yWh0L1v3d — Security Writeups Hugo en-us Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/secureform-admin/ Sat, 06 Jun 2026 00:00:00 +0000 https://th3b0ywh0l1v3d.github.io/ctf/dalctf-2026/web/secureform-admin/ A 4-digit PIN with no rate limiting falls to brute force, the dashboard’s ORDER BY sort is blind-SQL-injectable, and the home-made sanitizer only strips ‘<’ — so boolean extraction with ‘>’ dumps the secrets table.