webhard

No Quotes 3

uoftctf2026

Task: Flask app with WAF blocking quotes and periods, SHA256 double-check after SQL query, and SSTI in session. Solution: SQL quine via SHA2(REPLACE(..., HEX(...))) to bypass hash verification, combined with period-less SSTI using dict() attribute access.

$ ls tags/ techniques/
waf_bypasssqlimysqlsha256flasksstijinja2quine
backslash_escapehex_encodingunion_selectssti_rcesql_quinesha2_replace
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]