Calc

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: expression_injection, union_based_sqli

Summary

Walkthrough of the CUSTOM Web Calc. Task: Calculator web interface using SQL for expression evaluation. Solution: UNION-based SQL injection to extract flag from database.

Description

SQL injection task in the "advanced" category. A calculator-like web interface that evaluates mathematical expressions. The application uses SQL to perform calculations, creating an injection point.

URL: http://kslweb1.spb.ctf.su/sqli/calc/

Analysis

The application accepts mathematical expressions and evaluates them server-side using SQL. This creates a classic UNION-based SQL injection scenario where the expression parameter can be manipulated to extract data from the database. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• Calculator accepts expressions like 1+1, 2*3
• Backend likely uses SELECT <expression> to evaluate
• No proper input sanitization on the expression parameter

Solution

Step 1: Identify injection point

The expression parameter is directly interpolated into a SQL query. Testing with basic payloads confirms SQL injection.

Step 2: UNION-based extraction

Since the application returns the result of the calculation, UNION SELECT can be used to extract data:

 sql read-only • copy allowed Copy
1 UNION SELECT flag FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Or enumerate tables first:

 sql read-only • copy allowed Copy
1 UNION SELECT table_name FROM information_schema.tables--
1 UNION SELECT column_name FROM information_schema.columns WHERE table_name='flags'--
1 UNION SELECT flag FROM flags--

Step 3: Extract the flag

The UNION SELECT returns the flag from the database. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering expression_injection, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Calc • Difficulty: Medium