Hey fellow slackers, I just wanted to share with you this SQLi Challenge sponsored by Modsecurity. The challenge consists of two levels, the first one is a speed test which is pretty straight forward - Be one of the first 4 to extract the required data and you're a winner. The second challenge is where it gets juicy, here you'll have to extract the same data, but without triggering an Inbound alert. Second level offers a prize to any winner. Good luck!

[www.modsecurity.org]

I'm interested on how you might bypass the inbound alerts. The site I looked at was using an JetSQL (Access) database, which makes things difficult since there is not an inline commenting structure for it. I tried that and parameter pollution for my first attempts.

The test sites use different DBMS, so if you get stuck on one you can always try a different site. I'm close to solving level 2 using the Acuart site. Haven't really tried any of the other ones yet.

Do we have to get output or blind injection too all tables is fine?

blind SQLi is fine too as long as you can extract the data without triggering any alert.