K0G

This interactive room is built for a bigger screen. Watch the recorded run instead, or come back on desktop.

Watch the run → ← All demo rooms
/ Proof of exploit K0G-2026-0417 · run #8842 LIVE RUN 00:00.0
A real proof of exploit
k0g · agent runportal.whitmorehale.example
Blast radius · records reachable
0
records read0
● PROOF OF EXPLOIT
Unauthenticated SQL injection in the client portal chains to full administrative takeover
CRITICAL · CVSS 9.8 CWE-89 · SQL Injection OWASP A03:2021 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack chain — proven
1Client portal discovered T1595
2Credential spray — rejected T1110.003
3Injection confirmed · MySQL T1190 · CWE-89
4Auth bypass → admin session T1078
51,284 records reachable · 0 read T1213
Remediation — pull request #4471
 function findUser(u, p) {
-  const q = `SELECT * FROM users
-    WHERE username = '${u}'`;
+  const q = `SELECT * FROM users WHERE username = ?`;
+  return db.query(q, [u]);  // parameterised
 }
Proof captured — safely
counts, not contents · read, never write
Fix verified
payload replayed → 401 · path closed
Every finding ships with a proof of exploit.
MAP · REASON · EXPLOIT · CHAIN · PROVE · CLOSE
k0g.com/poc