Dead or alive 7

Platform: Web Kids20 | Category: Web | Type: Challenge | Difficulty: Easy | OS: NA | Author: D3v0o0Nu11 | Date: 2026-03-09 | Status: Solved Techniques: double_write_bypass, nested_keyword_injection

Summary

SQL injection bypass task. WAF uses preg_replace to remove SQL keywords.

Recon

Port scan

nmap -p- -sV -sC <TARGET> --min-rate 1000 -Pn

Enumeration highlights

• Event: web-kids20 | ID: 20260309_web_kids20_websql_bypass7
• Tags: waf_bypass, SQLi, mysql, preg_replace, keyword_filter
• Indicators: preg_replace removes SQL keywords, keywords like SELECT/UNION filtered, single removal pass (not recursive), WAF strips keywords once
• Source: 20260309_web_kids20_websql_bypass7.md

Foothold

Vulnerability / Misconfiguration

1. Double_write_bypass
2. Nested_keyword_injection

<command>

Exploitation

• See original writeup content for detailed exploitation.

Privilege Escalation

Enumeration

sudo -l
find / -perm -4000 2>/dev/null
getcap -r / 2>/dev/null
cat /etc/crontab
ps aux

Exploitation

1. N/A for challenge-type writeup; see exploitation above.
2. Flag obtained via challenge solve.

<command>

Flags

Key Takeaways / Lessons

• double_write_bypass
• nested_keyword_injection
• Tags: waf_bypass, SQLi, mysql, preg_replace, keyword_filter

Original Writeup

<details><summary>Click to expand original content</summary>

Description

SQL injection bypass task. WAF uses preg_replace to remove SQL keywords.

URL: http://kslweb1.spb.ctf.su/SQLi/bypass7/

Analysis

Seventh task in the SQL injection bypass series. WAF is implemented via PHP's preg_replace() function, which removes dangerous SQL keywords:

• SELECT
• UNION
• FROM
• and others

Key vulnerability: the filter performs only one pass of removal. This allows using the "double-write" technique — embedding a keyword inside itself so that after the inner part is removed, a valid keyword remains. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

Solution

Double-write bypass principle

If WAF removes SELECT from a string once:

• REDACTED → after removing SELECT from the middle → SELECT
• UNUNIONION → after removing UNION from the middle → UNION

Transformation examples

Payload

' UNUNIONION REDACTED flag FRFROMOM flags--

‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

After WAF processing:

' UNION SELECT flag FROM flags--

Alternative nesting options

You can nest at different positions:

• REDACTED — in the middle
• SELECTSELECT — won't work (first SELECT removed, SELECT remains)
• SSELECTELECT — SELECT removed, SELECT remains

The key is that after removing the inner occurrence, the letters "merge" into the desired word. ‍​‌‌​​​​‌​‌‌​​‌‌​​‌‌​​‌‌​​‌‌​​‌​​​​‌‌​​​​​‌‌​​‌‌​​‌‌​​‌​‌​‌‌​​‌​‌‍

</details>

---

Auto-tracked: saved to WriteUps; run /xesor-revise to fold lessons into XESXor_Methodology.md.

signed by XESXOR