Bypassing "OR" SQLi filter

Question

I am trying to bypass a filter on a black-box SQL injection CTF that likely looks like /or/i. I suspect the filter is in a WAF somewhere in between me and the target.

To get the OR keyword, I use ||.

Instead of using the ORD() function, I use ASCII().

But the DBMS is MySQL, how can I use INFORMATION_SCHEMA which contains "OR" as a substring as part of a statement such as SELECT ... FROM INFORMATION_SCHEMA.tables?

I tried bypassing the WAF via other ways but without success:

• URL-encoding
• Double URL-encoding
• UTF-8 encoding

Answer 1

Partial answer: if the MySQL version is recent enough (>5.5) and the user has enough privileges, it is possible to use the mysql.innodb_table_stats or mysql.innodb_table_stats tables (source) to retreive table names:

select table_name from mysql.innodb_table_stats where database_name=schema();