sql注入之like注入

注入

创建时间:2019-08-07 18:39

阅读:

脚本准备
测试
推荐阅读

今天在实战的过程中遇到了一个mssql的数据库，参数提交在了 like 后的参数里面，本地测试注入能成功，但是在实战的时候不晓得后端进行了什么处理，没拿下，哎~~

很烦，写篇博客纪念一下~

like后面的参数可控导致的注入，也没啥花里胡哨的技巧，原理都是互通的，就是注入方式看起来不一样。

不想搭建mssql+aspx的环境，就简单点搞mysql的吧~

环境：

phpstudy2014
php 5.4
mysql 5.5.40

脚本准备

like.php

<?php

$like = @$_GET['like'];

//id没有做 整形转换
if( !isset($like)|| empty($like) ){
    exit('get.like 参数不能为空');
}

try{
    //分别对应的是 地址，端口号，连接的数据库，编码
    $dsn = "mysql:host=127.0.0.1; port=3306; dbname=security; charset=utf8";

    //帐号
    $user = 'root';

    //密码 
    $psw ='root'; 

    //连接到 MySQL
    $pdo = new PDO($dsn,$user,$psw);

    //准备执行的sql语句  start
    $sql = "select * from users where username like '%$like%'";
    echo $sql;
    echo '<br/>';
    //准备执行的sql语句 end
    
    //进行查询数据库出问题则报具体错误
    $res = $pdo->query($sql) or var_dump($pdo->errorInfo());
 
    $mon = $res->fetch(PDO::FETCH_ASSOC);
    print_r( $mon );

} catch (Exception $e) {
    print $e->getMessage();
    exit();
}

?>

security.sql

/*
 Navicat Premium Data Transfer

 Source Server         : 本地
 Source Server Type    : MySQL
 Source Server Version : 50540
 Source Host           : localhost:3306
 Source Schema         : security

 Target Server Type    : MySQL
 Target Server Version : 50540
 File Encoding         : 65001

 Date: 07/08/2019 18:47:37
*/

SET NAMES utf8mb4;
SET FOREIGN_KEY_CHECKS = 0;

-- ----------------------------
-- Table structure for emails
-- ----------------------------
DROP TABLE IF EXISTS `emails`;
CREATE TABLE `emails`  (
  `id` int(3) NOT NULL AUTO_INCREMENT,
  `email_id` varchar(30) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = MyISAM AUTO_INCREMENT = 9 CHARACTER SET = gbk COLLATE = gbk_chinese_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of emails
-- ----------------------------
INSERT INTO `emails` VALUES (1, 'Dumb@dhakkan.com');
INSERT INTO `emails` VALUES (2, 'Angel@iloveu.com');
INSERT INTO `emails` VALUES (3, 'Dummy@dhakkan.local');
INSERT INTO `emails` VALUES (4, 'secure@dhakkan.local');
INSERT INTO `emails` VALUES (5, 'stupid@dhakkan.local');
INSERT INTO `emails` VALUES (6, 'superman@dhakkan.local');
INSERT INTO `emails` VALUES (7, 'batman@dhakkan.local');
INSERT INTO `emails` VALUES (8, 'admin@dhakkan.com');

-- ----------------------------
-- Table structure for referers
-- ----------------------------
DROP TABLE IF EXISTS `referers`;
CREATE TABLE `referers`  (
  `id` int(3) NOT NULL AUTO_INCREMENT,
  `referer` varchar(256) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  `ip_address` varchar(35) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = MyISAM AUTO_INCREMENT = 4 CHARACTER SET = gbk COLLATE = gbk_chinese_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of referers
-- ----------------------------
INSERT INTO `referers` VALUES (1, 'http://127.0.0.1/sqli-labs-master/Less-19/', '127.0.0.1');
INSERT INTO `referers` VALUES (2, 'http://127.0.0.1/sqli-labs-master/Less-19/', '127.0.0.1');
INSERT INTO `referers` VALUES (3, 'http://127.0.0.1/sqli-labs-master/Less-19/', '127.0.0.1');

-- ----------------------------
-- Table structure for uagents
-- ----------------------------
DROP TABLE IF EXISTS `uagents`;
CREATE TABLE `uagents`  (
  `id` int(3) NOT NULL AUTO_INCREMENT,
  `uagent` varchar(256) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  `ip_address` varchar(35) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  `username` varchar(20) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = MyISAM AUTO_INCREMENT = 15 CHARACTER SET = gbk COLLATE = gbk_chinese_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of uagents
-- ----------------------------
INSERT INTO `uagents` VALUES (1, '/', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (2, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (3, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (4, '/', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (5, 'and 1=1#', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (6, 'and 1=12#', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (7, 'order by 10#', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (8, 'order by 10#', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (9, '', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (10, '', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (11, '0', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (12, '0', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (13, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0', '127.0.0.1', 'admin');
INSERT INTO `uagents` VALUES (14, 'Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0', '127.0.0.1', 'admin');

-- ----------------------------
-- Table structure for users
-- ----------------------------
DROP TABLE IF EXISTS `users`;
CREATE TABLE `users`  (
  `id` int(3) NOT NULL AUTO_INCREMENT,
  `username` varchar(20) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  `password` varchar(20) CHARACTER SET gbk COLLATE gbk_chinese_ci NOT NULL,
  PRIMARY KEY (`id`) USING BTREE
) ENGINE = MyISAM AUTO_INCREMENT = 11 CHARACTER SET = gbk COLLATE = gbk_chinese_ci ROW_FORMAT = Dynamic;

-- ----------------------------
-- Records of users
-- ----------------------------
INSERT INTO `users` VALUES (1, 'Dumb', '1');
INSERT INTO `users` VALUES (2, 'Angelina', '1');
INSERT INTO `users` VALUES (3, 'Dummy', '1');
INSERT INTO `users` VALUES (4, 'secure', '1');
INSERT INTO `users` VALUES (5, 'stupid', '1');
INSERT INTO `users` VALUES (6, 'superman', '1');
INSERT INTO `users` VALUES (7, 'batman', '1');
INSERT INTO `users` VALUES (8, 'admin', 'admin');
INSERT INTO `users` VALUES (9, 'test#', '1');
INSERT INTO `users` VALUES (10, 'test\' #', '1');

SET FOREIGN_KEY_CHECKS = 1;