BUUOJ [CISCN2019 North Division Day2 Web1] Hack World

Make up the problem and the way to send articles blog

I do not know what this country is race time, the chicken or vegetable brush to a good title

0X01 test sites

SQL injection, blinds, numeric

 

0X02 try it yourself

 

 

 

Try to enter 1

 

 

Master Zhao need a girlfriend? ? ? Well just can have

Input 2

 

 

? ? ? Black question mark

 

Input 3

Submit empty

 

 

Enter the union are filtered ....

 

Every time sql injection is very confused and fuzz testing a ...

It found that many were filtered

 

Later found Master Zhao looked at the video

Write: ^ 1 ^ 1 by 1 point to bypass this knowledge

1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1))

 

Read bigwigs behind the script, found himself still too dishes, chicken dishes script is not Tieshanglai, Tell me what you can go and look at other scripts Gangster

There dichotomy, Boolean blinds, delay, etc.

Attach bigwigs blog:

https://blog.csdn.net/weixin_43345082/article/details/99062970

https://www.cnblogs.com/20175211lyz/p/11435298.html

https://www.cnblogs.com/kevinbruce656/p/11342580.html

 

The source of this problem, we want to help Gangster

 

<?php
$dbuser='root';
$dbpass='root';

function Safe ( $ SQL ) {
     # Content filtering function is not substantially filtered 
    $ BLACKLIST = Array ( '', '||', '#', '-', ';', '&', '+', ' or ',' and ',' ` ','" ',' insert ',' group ',' limit ',' update ',' delete ',' * ',' into ',' union ',' load_file ' , 'outfile', '/.' );
     the foreach ( $ BLACKLIST  AS  $ blackitem ) {
         IF ( stripos ( $ SQL , $ blackitem )) {
             return  False ;
        }
    }
    return True;
}
if(isset($_POST['id'])){
    $id = $_POST['id'];
}else{
    die();
}
$db = mysql_connect("localhost",$dbuser,$dbpass);
if(!$db){
    die(mysql_error());
}   
mysql_select_db("ctf",$db);

if(safe($id)){
    $query = mysql_query("SELECT content from passage WHERE id = ${id} limit 0,1");
    
    if($query){
        $result = mysql_fetch_array($query);
        
        if($result){
            echo $result['content'];
        }else{
            echo "Error Occured When Fetch Result.";
        }
    }else{
        var_dump($query);
    }
}else{
    die("SQL Injection Checked.");
}