The Plague has purchased the newest invention, Polygon Shifter to protect his website. This cutting edge technology is made available by Polygon Security, and they have a demo page on their website. They claim bots can no longer attack the website protected by the Polygon Shifter. Do we need to manually bruteforce the credentials?
On the Polygonshift website is a live demo form where you can login as user test/test or as user admin/?????. After logging in as user admin with password: a’ OR 1=1 and username=’admin’# we get the message
Hello, admin!! My password is the flag!. So, we have a blind SQLi and the goal is to get the password of the admin user.