level29

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: column_enumeration, union_based_sqli

Summary

Walkthrough of the CUSTOM Web level29. SQL injection task at http://kslweb1.spb.ctf.su/fourth/level29/

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level29/

Analysis

The application executes SQL queries directly with user input, allowing for UNION-based SQL injection. The key indicator is that column aliasing is used in the output, suggesting the query structure can be manipulated to extract data from other tables.

Solution

Standard UNION-based SQL injection approach:

1. Identify the number of columns in the original query
2. Use UNION SELECT to append a malicious query
3. Extract the flag from the database using column aliasing ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Example payload:

 sql read-only • copy allowed Copy
' UNION SELECT flag FROM flags--

Or with column enumeration:

 sql read-only • copy allowed Copy
' UNION SELECT 1,2,3--
' UNION SELECT flag,2,3 FROM flags--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering column_enumeration, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • level29 • Difficulty: Easy