level25

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: union_based_sqli

Summary

Walkthrough of the CUSTOM Web level25. SQL injection task from the sqlmap category. Standard UNION-based injection in a query parameter.

Description

SQL injection task from the sqlmap category. Standard UNION-based injection in a query parameter.

URL: http://kslweb1.spb.ctf.su/third/level25/

Analysis

The application accepts user input through a query parameter and directly incorporates it into a SQL query without proper sanitization. This allows for classic UNION-based SQL injection.

Solution

1. Identify the injection point in the query parameter
2. Determine the number of columns using ORDER BY or UNION SELECT NULL technique
3. Extract data using UNION SELECT with appropriate column count ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Using sqlmap for automated exploitation
sqlmap -u "http://kslweb1.spb.ctf.su/third/level25/?id=1" --dump

Or manual exploitation:

?id=1' UNION SELECT 1,2,3,flag FROM flags--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • level25 • Difficulty: Easy