Dead or alive 5

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: mixed_case_keyword_bypass

Summary

Task: SQL injection with WAF blocking SELECT keyword. Solution: Mixed case bypass (SeLeCt) since MySQL keywords are case-insensitive but the filter is case-sensitive.

Dead or alive 5 — Web Kids 2.0

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/sqli/bypass5/

The SELECT keyword is filtered by WAF.

Analysis

When trying to use SELECT in the payload, the request is blocked. However, the filter is case-sensitive — it only checks for exact matches of SELECT or select.

Key fact: MySQL keywords are case-insensitive. This means SELECT, select, SeLeCt — all work the same way.

Solution

Mixed case bypass

Instead of standard keywords, use mixed case: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Example payload

 sql read-only • copy allowed Copy
-- Blocked:
' UNION SELECT * FROM users--

-- Bypass:
' UnIoN SeLeCt * FrOm users--

Final payload

 sql read-only • copy allowed Copy
' UnIoN SeLeCt flag FrOm secret_table--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍