Web Gauntlet 2 (Medium)

  • Challenge Link: https://play.picoctf.org/practice/challenge/174?category=1&difficulty=2&page=3
  • Challenge Description: This website looks familiar...
  • Hints:
    1. I tried to make it a little bit less contrived since the mini competition.
    2. Each filter is separated by a space. Spaces are not filtered.
    3. There is only 1 round this time, when you beat it the flag will be in filter.php.
    4. There is a length component now.
    5. sqlite

Solution

Looking at the filters, it looks like we cannot use our previous injections from the first Web Gauntlet. So instead, we add some minor changes:

ad'||'min' except select 
,'

To explain, the SQL UNION operator is used to combine the result sets of two or more SELECT queries into a single, unified result table. So EXCEPT is like a reverse UNION, it removes matching rows. We add the space after select because we are beginning a new SELECT clause that the backend will finish for you.

The ,' is fixing syntax after your injected EXCEPT SELECT. 

picoCTF{0n3_m0r3_t1m3_85a265ac}

Sources