level25

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: union_based_sqli

Summary

SQL injection task from the sqlmap category. Standard UNION-based injection in a query parameter.

level25 — Web Kids 2.0

Description

SQL injection task from the sqlmap category. Standard UNION-based injection in a query parameter.

URL: http://kslweb1.spb.ctf.su/third/level25/

Analysis

The application accepts user input through a query parameter and directly incorporates it into a SQL query without proper sanitization. This allows for classic UNION-based SQL injection.

Solution

1. Identify the injection point in the query parameter
2. Determine the number of columns using ORDER BY or UNION SELECT NULL technique
3. Extract data using UNION SELECT with appropriate column count ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Using sqlmap for automated exploitation
sqlmap -u "http://kslweb1.spb.ctf.su/third/level25/?id=1" --dump

Or manual exploitation:

?id=1' UNION SELECT 1,2,3,flag FROM flags--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍