A guided walkthrough of the NITHUB Security Lab web CTF — six stages from a first robots.txt read to executive payroll. Directory discovery leaks backup files, a concatenated login query falls to SQL injection, an unchecked ?id= walks employee records up to the CEO, and a client-side role cookie hands over the admin panel. Each stage carries the why, not just the payload — built to teach the reasoning behind the chain.
robots.txt hands over a Disallow: /dev-backup — the same paths ffuf and gobuster would brute-force. Recon is mapping the attack surface./dev-backup exposes config.php.bak and notes.txt — the notes spell out three weaknesses that become the roadmap for the whole box.' OR '1'='1' -- in the username turns the concatenated login query always-true and comments out the rest — auth bypassed, redirected in as an employee.?id= without an ownership check; intercepting and walking 1002 → 1005 in Burp lands on the CEO's record.role=employee to role=admin — in Burp or straight in DevTools — unlocks /admin/payroll. Role checks belonged on the server, not in a client cookie.