Bypassing Basic PHP WAF to Read Files - "para-code" Web Challenge [DefCamp CTF 2022]

[@jorgevilla6523]

Thanks!

[@_CryptoCat]

🥰

[@linodexplod1575]

💯% helpful sick Tricks. always anxious for alerts when you upload a new video!

[@_CryptoCat]

Awww great to hear, thanks mate! 🥰

[@rahulkrishnan4509]

could you also make a video for it-support

[@_CryptoCat]

I didn't do that one 😬 Did you see any good writeups for it?

[@_techwaves]

🔥🔥

[@_CryptoCat]

🥰

[@hva8055]

Sir, can we use this method for other injection like SQL, etc.. thanks for teaching a new way to find vulnerability 🤩🤩

[@_CryptoCat]

Not much from this challenge will carry over to SQLi but the "PHP Tricks (SPA)" and "Bash Filter Evasion" techniques we looked at on HackTricks might help with future PHP filter bypass and command injection challenges.
For SQLi specifically there are many ways to bypass blacklisted chars though e.g. portswigger.net/support/sql-injection-bypassing-common-filters 😉 Thanks for the feedback 🥰

[@hva8055]

@@_CryptoCat thank you so much sir

[@0xgodson119]

[@_CryptoCat]

💜