I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target.

To get the OR keyword, I use ||.

Instead of using the ORD() function, I use ASCII().

But the DBMS is MySQL, how can I use INFORMATION_SCHEMA which contains "OR" as a substring as part of a statement such as SELECT ... FROM INFORMATION_SCHEMA.tables?

I tried bypassing the WAF via other ways but without success:

  • URL-encoding
  • Double URL-encoding
  • UTF-8 encoding
  • 1
    This is pure programming question and is off topic on Security SE.
    – mentallurg
    Feb 11, 2022 at 22:44
  • What make you think there is a WAF? A specific HTTP status code or response? It's very possible and even likely there is one, then try to confirm this hypothesis, and even better try to identify the WAF in question. Perhaps you can then research the limitations of that particular WAF to bypass them.
    – Kate
    Feb 12, 2022 at 13:50

1 Answer 1


Partial answer: if the MySQL version is recent enough (>5.5) and the user has enough privileges, it is possible to use the mysql.innodb_table_stats or mysql.innodb_table_stats tables (source) to retreive table names:

select table_name from mysql.innodb_table_stats where database_name=schema();

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .