A codoon website needs to be filtered for SQL Injection

A codoon website needs to be filtered for SQL Injection

It's a bit cold ~ Find a hole to play ~

The domain name of codoy should be www2.kugou.kugou.com, but it is obvious that the domain name is cname on the CDN node.


 

As a result, the ip address of the Origin Site is found, and the following injection occurs:



Http: // 183.61.119.243/show/more/type = 10 & orderby = hits & page = 1 & page_size = 24



Time-based blind Injection



Database username


 

Database Name


 

 

The domain name of codoy should be www2.kugou.kugou.com, but it is obvious that the domain name is cname on the CDN node.
 

As a result, the ip address of the Origin Site is found, and the following injection occurs:

Http: // 183.61.119.243/show/more/type = 10 & orderby = hits & page = 1 & page_size = 24



Time-based blind Injection



Database username
 

Database Name
 

 

Solution:

Filter