Bypass

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: filter_evasion, numeric_sqli

Summary

SQL injection bypass task at http://kslweb1.spb.ctf.su/SQLi/bypass3/

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_websql_bypass3
• Tags: SQLi, filter_bypass, numeric_injection
• Indicators: quote and comment characters filtered, numeric parameter in SQL query, id= or similar numeric input
• Source: 20260309_web_kids20_websql_bypass3.md

Foothold

Vulnerability / Misconfiguration

1. Filter_evasion
2. Numeric_sqli

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• filter_evasion
• numeric_sqli
• Tags: SQLi, filter_bypass, numeric_injection

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass task at http://kslweb1.spb.ctf.su/SQLi/bypass3/

Analysis

SQL injection filter bypass task. The following are filtered:

• Quotes (', ")
• Comment characters (--, #, /*)

However, the injection point is a numeric parameter, which allows bypassing the filter without using quotes.

Solution

Since the parameter is numeric (e.g., id=1), quotes are not needed for injection. SQL constructs can be added directly:

?id=1 OR 1=1
?id=1 UNION SELECT 1,2,3
?id=-1 UNION SELECT 1,flag,3 FROM flags

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Key point: numeric parameters in SQL do not require quote wrapping, so quote filtering does not affect the injection possibility.

To bypass comment filtering:

1. Use OR 1=1 without commenting out the rest of the query
2. Balance the query so it remains syntactically correct ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR