Interesting challenge. Solved it using 2 different ways. If spoiler than remove it. You can using information_schema to solve this problem and then there is another place to look for. sqlmap didn’t help me much . I used union of burp and a local instance of mysqldb to solve this problem. Good learning.
can someone help me with notice 2? i cannt found parameter to solve that
I used to only do boxes… i discovered that those challenges are good for learning new techniques/tools… although the reward in points is very poor. 
any hint to bypass the fire wall, i know firewall will block some special character and word but i have no idea to bypass that, can someone give me nudge?
Type your comment> @0xstain said:
any hint to bypass the fire wall, i know firewall will block some special character and word but i have no idea to bypass that, can someone give me nudge?
don’t use the forbidden characters and words. Find a way to achieve what you need without them.
I managed to solve that one but everytime i am faces with SQLi and bypassing filters, i notice how poor my methodology is… i am pretty much emptying my bag on a table and trying randomly one thing after the other, i find it hard to have a plan with that sort of issues… any advice/links, i’d be interested…
Type your comment
Can someone help me out. I passed the notice part but stuck at the sqli. I know which words are filtered but I cant get any information out of this thing. No progress since days…