webhard

No Quotes 2

uoftctf2026

Task: Flask app with quote-filtering WAF and double-check verification (input == db_result). Solution: SQL injection via backslash escape combined with INFORMATION_SCHEMA.PROCESSLIST for self-referential payload to bypass double-check, then SSTI for RCE.

$ ls tags/ techniques/
waf_bypasssqlimysqlflasksstijinja2quineprocesslist
backslash_escapehex_encodingunion_selectssti_rceself_referential_sqlfixed_point_payload
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]