PicoCTF Web Gauntlet Writeup: Beating SQL Filters with String Concatenation

Web Gauntlet is a picoCTF web exploitation challenge built around progressively stricter SQL filters. Each round blocks more keywords or operators, but the goal stays the same: log in as admin.

Core Idea

The key bypass is to avoid typing admin directly and build it inside the SQL expression instead. SQLite supports string concatenation with ||, so ad'||'min evaluates to admin.

Rounds 1-5

The same idea works across the rounds because the filter blocks common SQL injection words and operators, but it does not break the concatenation approach.

Username: ad'||'min';
Password: 1

The resulting query shape is:

SELECT * FROM users WHERE username='ad'||'min';' AND password='1'

Round 2 filters terms such as or, and, like, =, and --, but the concatenation payload still avoids them.

Round 3 expands the blocked list with comparison operators, but the payload still does not depend on those operators.

Round 4 blocks admin, which is exactly why splitting the string into ad and min matters.

Round 5 also blocks union, but this solve path does not need UNION-based extraction.

Flag

After completing the gauntlet, the final page returned the flag.

Key Takeaways

1. Blacklist filters are brittle because alternate SQL syntax can preserve the same meaning.
2. SQLite string concatenation with || is useful when a literal keyword is blocked.
3. A good bypass avoids the filtered tokens entirely instead of trying small variations of the same blocked payload.