technique://SQL Injection

MariaDB root with no password on port 3306 — from initial banner grab to database enumeration to flag extraction, no exploit required.

SQL injection in a login form — `' OR '1'='1` as username turns authentication into a formality and exposes the flag in one request.