9.二次注入
原理
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710675-1082070274.png)
图解
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710472-1351627550.png)
实例解析原理
user_id='1''查询报错
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710428-679486811.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710370-33224534.png)
user_id='1\''正确查询
二次注入代码审计
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710526-1908765615.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710330-326805573.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710524-489491126.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710499-1384089166.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710325-1466754914.png)
黑盒测试下的二次注入
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710503-567379726.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710462-1415696328.png)
实战1:修改目标账户密码
前置要求,现在我们有一个目标账号hudongyang
但是我们不知道他的密码,怎么办呢,可以利用二次注入
这是hudongyang的账号
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709815-2011055479.png)
账号hudongyang密码123456789
我们登录
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709817-933783743.png)
登录成功
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709825-1944887580.png)
这时,我们再创建一个hudongyang'#账号
密码为111111
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710292-1003560816.png)
这时我们登录hudongyang'#的账号修改他的密码
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709849-952158570.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709852-1578087511.png)
将它的密码改为222222
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709884-621045389.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709970-1633019027.png)
密码更新成功
这时,我们更新的其实是hudongyang的密码
我们利用密码222222登录hudongyang账号
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710206-945084058.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710438-127707451.png)
登录成功!!!
这就是二次注入!
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100710216-1472600376.png)
hudongyang'#的密码没变
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100709915-1204860965.png)
登录成功
从用户角度来说,这个账户的密码永远不会被修改的