Background alternative Injection

When I watched the news tonight, I saw an advertisement, and then I clicked on a site ....

Then you know, and then it starts.

There will be no injection at the front-end, And I will omit the previous processes...

Jump directly to the background

Simple background, casually tested. If we enter the admin password and casually lose, it will appear

What if you enter admin?

 

A little bit, this is also a clear injection... but how to use this injection point is a problem? Havij? Paglon? Sqlmap?

There is a verification code here, but this verification code is found to be useless through the background ...... sqlmap cannot be injected .....

It can only be done manually... think about how to use it?

Does anyone know how to handle this process?

He first compares the password with the user name in the database. If the password is the same, the password is retrieved and compared with the entered password. Then, if the password is the same, the login is successful ....

With this process, we can determine

We can inject it like this // hi.baidu.com/sethc5

Admin 'order by 10 #

We can first determine the field and determine that the field is 4 by using the semi-division method.

Then we can join the query ....

Admin 'and 1 = 2 union select 1, 2, 3, 4 #

 

Prompt Password error

The preceding statement is correct.

We can change the preceding statement to this

Admin 'and 1 = 2 union select #

Enter 1 in the password.

Is the Verification Successful ??

But it cannot be verified.

Do you know why? // Hi.baidu.com/sethc5

You can think about it. The password you entered will generally be md5 encrypted. It is also md5 encrypted to retrieve the password from the database!

So here we need md5 for both 1, 1, and 1 .....

Let's try...

Modify it to admin' and 1 = 2 union select c4ca4238a0b923820dcc509a6f75849b, c4ca4238a0b923820dcc509a6f75849b, region, Region #

Enter 1 www.2cto.com in the password field.

Is this true?

Let's verify

Nima prompts that the user name does not exist. Why ??? Isn't it true?

Dear friends, can you find out what is going on?

I will test it for you

 

Here we passed. If we try to modify a field, we will change 12 to a to see what will happen?

 

He will report an error ....

So you know, don't explain it. We need to add single quotes ....

Let's test

 

 

So .....

We can modify the previous one, right?

We can modify it like this...

Username Input

Admin 'and 1 = 2 union select 'c4ca4238a0b923820dcc509a6f75849b', 'c4ca4238a0b923820dcc509a6f75849b ', 'hangzhou', 'hangzhou '#

Enter 1 in Password

Then let's see what happened ....

Haha

Let's go!

 

Then the background is very simple

There is a place to upload ....

Cannot directly upload shell

Only gif and flash files can be uploaded.

After testing, it is found that only the file type is verified. If spoofed, modify the data packet and get a shell

That's it ....

 

But at the end, I want to discuss a question with you?

 

 

Why does the dual table exist in mysql? Isn't it from oracle? I thought it was oracle before the test ....

But the dual table does not exist in this database... but he was founded, hoping that he could tell me about it ....