Dead or alive 5

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: mixed_case_keyword_bypass

Summary

Task: SQL injection with WAF blocking SELECT keyword. Solution: Mixed case bypass (SeLeCt) since MySQL keywords are case-insensitive but the filter is case-sensitive.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260309_webkids20_websql_bypass5
• Tags: waf_bypass, SQLi, mysql, case_bypass, keyword_filter
• Indicators: SELECT keyword filtered, case-sensitive keyword filter, SQL keywords blocked
• Source: 20260309_webkids20_websql_bypass5.md

Foothold

Vulnerability / Misconfiguration

1. Mixed_case_keyword_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• mixed_case_keyword_bypass
• Tags: waf_bypass, SQLi, mysql, case_bypass, keyword_filter

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/SQLi/bypass5/

The SELECT keyword is filtered by WAF.

Analysis

When trying to use SELECT in the payload, the request is blocked. However, the filter is case-sensitive — it only checks for exact matches of SELECT or select.

Key fact: MySQL keywords are case-insensitive. This means SELECT, select, SeLeCt — all work the same way.

Solution

Mixed case bypass

Instead of standard keywords, use mixed case: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Example payload

-- Blocked:
' UNION SELECT * FROM users--

-- Bypass:
' UnIoN SeLeCt * FrOm users--

Final payload

' UnIoN SeLeCt flag FrOm secret_table--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR