webeasy

Dead or alive 7

spbctf

Task: perform SQL injection when a WAF uses preg_replace to strip SQL keywords in a single pass. Solution: double-write bypass — nest keywords inside themselves (SELSELECTECT, UNUNIONION, FRFROMOM) so that after one removal pass, valid SQL keywords remain.

$ ls tags/ techniques/
waf_bypasssqlimysqlpreg_replacekeyword_filter
double_write_bypassnested_keyword_injection
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]