level30

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: like_clause_injection, union_based_sqli

Summary

Walkthrough of the CUSTOM Web level30. SQL injection task at http://kslweb1.spb.ctf.su/fourth/level30/

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level30/

Analysis

The application uses a LIKE clause in the SQL query for search functionality. The user input is directly concatenated into the LIKE pattern, allowing for UNION-based SQL injection by escaping the LIKE clause context.

Key vulnerability: Input is placed inside a LIKE clause without proper sanitization, allowing injection after closing the pattern.

Solution

UNION-based injection in LIKE clause: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Close the LIKE pattern with %'
2. Add UNION SELECT to extract data from other tables
3. Comment out the rest of the query

Example payload:

 sql read-only • copy allowed Copy
%' UNION SELECT flag FROM flags--

Or with column matching:

 sql read-only • copy allowed Copy
%' UNION SELECT 1,flag,3 FROM flags--

The injection point is within the LIKE clause, so we need to properly escape it first before adding our UNION statement. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering like_clause_injection, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • level30 • Difficulty: Easy