sqlilab less11-less18

 

 

 

less-11

uname和passwd直接带入查询，万能密码

 

 

 sqlmap自动搜索表单，或者抓包后用-r参数

 

 

 

---

 

less-12

post数据用小括号进行包裹，构造万能密码") or 1=1 #

 

 

---

 

less-13

将mysql_error()返回前端，且用‘）包裹，构造') or 1=1 #

 

 

---

 

less-14

post的数据用双引号包裹，构造万能密码"or 1=1 #

 

 

---

less-15

报错不返回前端，考虑布尔和时间盲注

 

 

 

 

 

 

 

 

---

less-16

与15思路相同，但是由小括号，双引号包裹

 

 

 

 

 

 

 

---

 

less17

这里是更新用户的密码。

加入了过滤函数，只将uname带入查询，并对uname进行处理

function check_input($value)
    {
    if(!empty($value))   //不能为空
        {
        // truncation (see comments)
        $value = substr($value,0,15);   //只获取前15位字符串
        }

        // Stripslashes if magic quotes enabled
        if (get_magic_quotes_gpc())  如果开启了gpc
            {
            $value = stripslashes($value);  用这个函数处理
            }

        // Quote if not a number
        if (!ctype_digit($value))如果不是数字的话，对特殊字符进行转义，并包裹单引号
            {
            $value = "'" . mysql_real_escape_string($value) . "'";
            }
        
    else
        {
        $value = intval($value);
        }
    return $value;
    }

但是，防御函数只处理了uname变量，并未对passwd处理。

 

 

 

 

---

 

less-18

这里提示了IP，可能是xxf注入

 

 通过分析源码，这里对uname和passwd参数进行了处理，但是还有两个新的全局变量可控，ip和user-agent

function check_input($value)
    {
    if(!empty($value))
        {
        // truncation (see comments)
        $value = substr($value,0,20);
        }

        // Stripslashes if magic quotes enabled
        if (get_magic_quotes_gpc())
            {
            $value = stripslashes($value);
            }

        // Quote if not a number
        if (!ctype_digit($value))
            {
            $value = "'" . mysql_real_escape_string($value) . "'";
            }
        
    else
        {
        $value = intval($value);
        }
    return $value;
    }



    $uagent = $_SERVER['HTTP_USER_AGENT'];
    $IP = $_SERVER['REMOTE_ADDR'];
    echo "<br>";
    echo 'Your IP ADDRESS is: ' .$IP;
    echo "<br>";
    //echo 'Your User Agent is: ' .$uagent;
// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))

    {
    $uname = check_input($_POST['uname']);
    $passwd = check_input($_POST['passwd']);
    
    /*
    echo 'Your Your User name:'. $uname;
    echo "<br>";
    echo 'Your Password:'. $passwd;
    echo "<br>";
    echo 'Your User Agent String:'. $uagent;
    echo "<br>";
    echo 'Your User Agent String:'. $IP;
    */

    //logging the connection parameters to a file for analysis.    
    $fp=fopen('result.txt','a');
    fwrite($fp,'User Agent:'.$uname."\n");
    
    fclose($fp);
    
    
    
    $sql="SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
    $result1 = mysql_query($sql);
    $row1 = mysql_fetch_array($result1);
        if($row1)
            {
            echo '<font color= "#FFFF00" font size = 3 >';
            $insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";
            mysql_query($insert);
            //echo 'Your IP ADDRESS is: ' .$IP;
            echo "</font>";
            //echo "<br>";
            echo '<font color= "#0000ff" font size = 3 >';            
            echo 'Your User Agent is: ' .$uagent;
            echo "</font>";
            echo "<br>";
            print_r(mysql_error());            
            echo "<br><br>";
            echo '<img src="../images/flag.jpg"  />';
            echo "<br>";
            
            }
        else
            {
            echo '<font color= "#0000ff" font size="3">';
            //echo "Try again looser";
            print_r(mysql_error());
            echo "</br>";            
            echo "</br>";
            echo '<img src="../images/slap.jpg"   />';    
            echo "</font>";  
            }

    }

当–level参数设定为3或者是3以上时，会尝试对User-Agent进行注入测试