Bypass

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: filter_evasion, numeric_sqli

Summary

Walkthrough of the CUSTOM Web Bypass. SQL injection bypass task at http://kslweb1.spb.ctf.su/sqli/bypass3/

Description

SQL injection bypass task at http://kslweb1.spb.ctf.su/sqli/bypass3/

Analysis

SQL injection filter bypass task. The following are filtered:

• Quotes (', ")
• Comment characters (--, #, /*)

However, the injection point is a numeric parameter, which allows bypassing the filter without using quotes.

Solution

Since the parameter is numeric (e.g., id=1), quotes are not needed for injection. SQL constructs can be added directly:

?id=1 OR 1=1
?id=1 UNION SELECT 1,2,3
?id=-1 UNION SELECT 1,flag,3 FROM flags

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key point: numeric parameters in SQL do not require quote wrapping, so quote filtering does not affect the injection possibility.

To bypass comment filtering:

1. Use OR 1=1 without commenting out the rest of the query
2. Balance the query so it remains syntactically correct ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering filter_evasion, numeric_sqli was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Bypass • Difficulty: Easy