Lina

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: limit_bypass, sql_comment_injection

Summary

Walkthrough of the CUSTOM Web Lina. Task: SQL injection with LIMIT 0 preventing results. Solution: Use comment injection (-- ) to bypass LIMIT clause.

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/lina

Beginner-level SQL injection challenge (1 point) from Web Kids 2.0 CTF platform.

Analysis

The task is a basic SQL injection. Upon analyzing the query, it was discovered that LIMIT 0 is appended to the SQL query, which prevents any results from being returned even when the query executes successfully.

Key problem: the query has the form:

 sql read-only • copy allowed Copy
SELECT * FROM table WHERE condition LIMIT 0

Solution

Using classic SQL injection with a comment to bypass LIMIT: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Payload:

' OR 1=1 --

This payload:

1. ' — closes the string literal
2. OR 1=1 — makes the condition always true, returning all records
3. -- — comments out the rest of the query, including LIMIT 0

The resulting query becomes:

 sql read-only • copy allowed Copy
SELECT * FROM table WHERE field='' OR 1=1 -- LIMIT 0

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Key Takeaways / Lessons

• Mastering limit_bypass, sql_comment_injection was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Lina • Difficulty: Easy