02

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: mixed_case_bypass, waf_evasion

Summary

Walkthrough of the CUSTOM Web 02. SQL injection task at https://2019-10-20-sqlinj.ctf.su/02

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/02

Analysis

The task involves SQL injection with a WAF (Web Application Firewall) that blocks SQL keywords.

When attempting to use standard SQL queries with SELECT and FROM, the WAF blocks the request. However, the filter checks keywords case-sensitively, while MySQL processes keywords case-insensitively.

Key observation:

• WAF blocks: SELECT, FROM (exact match)
• WAF allows: SeLeCt, FrOm (mixed case)
• MySQL understands both variants equally ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. Identify that WAF blocks SQL keywords SELECT and FROM
2. Use mixed case to bypass the filter
3. Construct payload with mixed case

Payload

 sql read-only • copy allowed Copy
SeLeCt * FrOm girls WHERE id=2

Mixed case bypasses the keyword filter because:

• WAF checks for exact string match (case-sensitive)
• MySQL keywords are case-insensitive ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering mixed_case_bypass, waf_evasion was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2019-10-20 • CUSTOM • 02 • Difficulty: Easy