Decoder

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: login_form_injection, second_order_sql_injection

Summary

Walkthrough of the CUSTOM Web Decoder. "Enjoy this useful service. Username: admin, password: admin." Source code available.

Description

"Enjoy this useful service. Username: admin, password: admin." Source code available.

URL: http://hackyou-web200.ctf.su/

Analysis

The task provides a web service with a login form and base64 decoding functionality. Source code is available, revealing the SQL query:

 sql read-only • copy allowed Copy
SELECT * FROM users WHERE login='$login' AND password='$password'

After successful login, the user gains access to the base64 decoding function. The key vulnerability is a second-order SQL injection through the uid field, which is saved during login and used in subsequent queries without sanitization. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. Analyzed the source code and discovered SQL injection in the login form
2. The query login='$login' AND password='$password' is vulnerable to classic SQL injection
3. Used injection to extract the flag from the database

Example payload for login:

login: admin' OR '1'='1' --
password: anything

Or via UNION-based injection to extract data:

login: ' UNION SELECT 1,2,flag FROM secrets --
password: x

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering login_form_injection, second_order_sql_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Decoder • Difficulty: Easy