Mini-game · Chapter 5

WAF Bypass

Three rounds. The vulnerable endpoint behind the WAF is the same in each: SELECT * FROM users WHERE name='${'$'}{input}'. Your goal: return the admin row. The WAF rules get longer each round. Find an input that passes the filter and dumps the admin.

Educational training material. This game demonstrates an attack technique inside a sandboxed quiz UI for security learning. Do not apply these techniques against systems you do not own or have explicit written permission to test.

Round 1 / 3 Score 0 Attempts 0 Time 00:00