Kurome

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: direct_query, no_injection_needed

Summary

Walkthrough of the CUSTOM Web Kurome. SQL injection task at https://2019-10-20-sqlinj.ctf.su/kurome

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/kurome

A page with a search form that queries a database of anime girls.

Analysis

The search form executes an SQL query like:

 sql read-only • copy allowed Copy
SELECT * FROM girls WHERE name='<input>'

Despite the task being positioned as SQL injection, getting the flag only requires entering the correct character name.

Kurome is a character from the anime "Akame ga Kill!", sister of the main heroine Akame.

Solution

1. Open the page https://2019-10-20-sqlinj.ctf.su/kurome
2. Enter in the search field: Kurome
3. Click search
4. The results display a record with the flag in the secret column ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

No SQL injection required — just querying the correct name. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering direct_query, no_injection_needed was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-10-20 • CUSTOM • Kurome • Difficulty: Easy