// Breach the Portal

A live, genuinely vulnerable employee login page — find the flaw and read data you shouldn't be able to.

Stay in scope. Every artifact here is synthetic — built for this challenge, not captured from a real system. Apply the same techniques only against systems you own or are explicitly authorized to test.

// Target

Employee Portal (Live Target) A real running login page — this one is actually exploitable, not a simulation

// Your Toolbox

Your browser No special tools needed — a login form and some SQL intuition is enough.
SQL injection basics A classic auth-bypass payload breaks out of a quoted string and neutralizes the rest of the query — e.g. ending the username with a quote, then commenting out whatever follows.

// Situation

A small internal tool for the campus IT team leaked its login URL. It's a basic username/password form — nothing fancy. Nothing about the page itself hints at a problem. The problem is in how it checks your password.

// The Challenge

01 medium

Bypass the Login

You don't have a valid password for any account — you're not supposed to. Get past the login anyway, land in the administrator's account, and read what's sitting in their notes.