← Back to Writeups
CUSTOMEasyWeb
Bookmark

level27

XESXOR9/10/20261 min read
#web#custom#easy#union_based_sqli#linux

level27

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: union_based_sqli

Summary

SQL injection task from the sqlmap category. Standard UNION-based injection in a query parameter.

level27 — Web Kids 2.0

Description

SQL injection task from the sqlmap category. Standard UNION-based injection in a query parameter.

URL: http://kslweb1.spb.ctf.su/third/level27/

Analysis

The application accepts user input through a query parameter and directly incorporates it into a SQL query without proper sanitization. This allows for classic UNION-based SQL injection.

Solution

  1. Identify the injection point in the query parameter
  2. Determine the number of columns using ORDER BY or UNION SELECT NULL technique
  3. Extract data using UNION SELECT with appropriate column count ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍
 bash 
# Using sqlmap for automated exploitation
sqlmap -u "http://kslweb1.spb.ctf.su/third/level27/?id=1" --dump

Or manual exploitation:

?id=1' UNION SELECT 1,2,3,flag FROM flags--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍