level29

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: column_enumeration, union_based_sqli

Summary

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level29/

level29 - Web Kids 2.0

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level29/

Analysis

The application executes SQL queries directly with user input, allowing for UNION-based SQL injection. The key indicator is that column aliasing is used in the output, suggesting the query structure can be manipulated to extract data from other tables.

Solution

Standard UNION-based SQL injection approach:

1. Identify the number of columns in the original query
2. Use UNION SELECT to append a malicious query
3. Extract the flag from the database using column aliasing ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

Example payload:

 sql read-only • copy allowed Copy
' UNION SELECT flag FROM flags--

Or with column enumeration:

 sql read-only • copy allowed Copy
' UNION SELECT 1,2,3--
' UNION SELECT flag,2,3 FROM flags--

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍