← Back to Writeups
CUSTOMEasyWeb
Bookmark

02

XESXOR9/10/20261 min read
#web#custom#easy#mixed_case_bypass#waf_evasion

02

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2019-10-20 | Status: Solved Techniques: mixed_case_bypass, waf_evasion

Summary

SQL injection task at https://2019-10-20-sqlinj.ctf.su/02

02 — Web Kids 2.0

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/02

Analysis

The task involves SQL injection with a WAF (Web Application Firewall) that blocks SQL keywords.

When attempting to use standard SQL queries with SELECT and FROM, the WAF blocks the request. However, the filter checks keywords case-sensitively, while MySQL processes keywords case-insensitively.

Key observation:

  • WAF blocks: SELECT, FROM (exact match)
  • WAF allows: SeLeCt, FrOm (mixed case)
  • MySQL understands both variants equally ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

  1. Identify that WAF blocks SQL keywords SELECT and FROM
  2. Use mixed case to bypass the filter
  3. Construct payload with mixed case

Payload

 sql 
SeLeCt * FrOm girls WHERE id=2

Mixed case bypasses the keyword filter because:

  • WAF checks for exact string match (case-sensitive)
  • MySQL keywords are case-insensitive ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍