02 - 20191020_web_kids20_websql_zerotwo

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2019-10-20 | Status: Solved Techniques: mixed_case_bypass, waf_evasion

Summary

SQL injection task at https://2019-10-20-sqlinj.ctf.su/02

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20191020_web_kids20_websql_zerotwo
• Tags: waf_bypass, SQLi, mysql, case_sensitivity
• Indicators: WAF blocks SQL keywords, case-sensitive keyword filter, MySQL backend
• Source: 20191020_web_kids20_websql_zerotwo.md

Foothold

Vulnerability / Misconfiguration

1. Mixed_case_bypass
2. Waf_evasion

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• mixed_case_bypass
• waf_evasion
• Tags: waf_bypass, SQLi, mysql, case_sensitivity

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection task at https://2019-10-20-sqlinj.ctf.su/02

Analysis

The task involves SQL injection with a WAF (Web Application Firewall) that blocks SQL keywords.

When attempting to use standard SQL queries with SELECT and FROM, the WAF blocks the request. However, the filter checks keywords case-sensitively, while MySQL processes keywords case-insensitively.

Key observation:

• WAF blocks: SELECT, FROM (exact match)
• WAF allows: SeLeCt, FrOm (mixed case)
• MySQL understands both variants equally ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

1. Identify that WAF blocks SQL keywords SELECT and FROM
2. Use mixed case to bypass the filter
3. Construct payload with mixed case

Payload

SeLeCt * FrOm girls WHERE id=2

Mixed case bypasses the keyword filter because:

• WAF checks for exact string match (case-sensitive)
• MySQL keywords are case-insensitive ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR