Dead or alive 2

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: addslashes_bypass_hex

Summary

SQL injection bypass task at http://kslweb1.spb.ctf.su/sqli/bypass2/. "Find out how many quotes you have left on this mortal earth in my new service."

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_websql_bypass2
• Tags: sqli, mysql, hex_encoding, bypass, addslashes
• Indicators: addslashes() used for escaping, MySQL database, quotes being escaped but hex not filtered
• Source: 20260309_web_kids20_websql_bypass2.md

Foothold

Vulnerability / Misconfiguration

1. addslashes_bypass_hex

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• addslashes_bypass_hex
• Tags: sqli, mysql, hex_encoding, bypass, addslashes

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass task at http://kslweb1.spb.ctf.su/sqli/bypass2/. "Find out how many quotes you have left on this mortal earth in my new service."

Analysis

The application uses addslashes() PHP function to escape user input. This function escapes single quotes ('), double quotes ("), backslashes (\), and NULL bytes by prepending a backslash.

However, addslashes() does not protect against all SQL injection vectors. In MySQL, strings can be represented in hexadecimal format (0x...) without requiring quotes. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key observations:

• Input is passed through addslashes() before being used in SQL query
• MySQL is the backend database
• Hex-encoded strings (0x...) are valid string literals in MySQL and don't need quotes

Solution

Step 1: Identify the vulnerability

The application escapes quotes using addslashes(), but this can be bypassed using hex encoding.

Step 2: Convert payload to hex

Instead of using quoted strings like 'admin', convert to hex format:

• admin = 0x61646d696e

Step 3: Craft the injection payload

Example payload structure:

 sql read-only • copy allowed Copy
1 UNION SELECT * FROM users WHERE username=0x61646d696e

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Python helper for hex conversion:

 python read-only • copy allowed Copy
#!/usr/bin/env python3
"""
addslashes() bypass via hex encoding
"""

def string_to_hex(s):
    """Convert string to MySQL hex format (0x...)"""
    return '0x' + s.encode().hex()

# Example usage
payload = "admin"
hex_payload = string_to_hex(payload)
print(f"Original: {payload}")
print(f"Hex: {hex_payload}")

# For SQL injection:
# Instead of: ' OR username='admin'
# Use: ' OR username=0x61646d696e

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR