Injection Point judgment and Prediction

Injection Point judgment and Prediction
I. Judgment and Prediction of injection points 1. Add single quotation marks to submit. Result: if an error message is displayed, the website may have an injection vulnerability. 2. number type to determine whether there is an injection; Statement: and 1 = 1; and 1 = 2 (Classic), 'and '1' = 1 (numeric) Results: return different pages, respectively, the injection vulnerability exists. analysis: and means "and". If we do not filter our statements, and 1 = 1 will be substituted into the SQL query statement for query, if the two statements before and after "and" are true, there will be no errors, but if one of the statements before and after is false, the program will be violent and wrong. This indicates that the program has an injection vulnerability to prevent injection. Solution: 1> use or 2> 1; or 1> 2 to determine the result. Different pages are returned, indicating that the injection vulnerability exists. analysis: or injection only requires the first and second statements to be true if one of them is correct. If both statements are correct, they are false. Remember: if the statement after or is correct during or injection, the error page is returned! If an error occurs, the correct page is returned, indicating that an injection point exists. 2> use xor 1 = 1; xor 1 = 2 Results: different pages are returned, indicating the injection vulnerability exists. analysis: xor represents an exclusive or, which means that only one connected expression is true. Remember: When xor is injected, if the statement following xor is correct, the error page area is returned. If it is incorrect, the correct page is returned, indicating that there is an injection point. 3> convert and 1 = 1 to URL encoding. Then, submit and 1 = 1 URL encoding: % 41% 4E % 44% % 20% 3D % 31 4> use-1; -0 analysis: If the returned page is different from the previous page and is another news item, it indicates an injection vulnerability, which is a digital injection vulnerability. Add-0 to the URL address, the URL is changed to news. asp? Id = 123-0. The returned page is the same as the previous page. If-1 is added, the error page is returned, indicating that the injection vulnerability exists. 3. statement: 'and '1' = 1;' and '1 = 2 (Classic) Result: different pages are returned, indicating the injection vulnerability exists. analysis: Add 'and' 1' = 1 to return the correct page, and add 'and' 1 = 2 to return the error page, which indicates that injection leaks are the same. Anti-injection solution: 1> Add '% 2B' (scheme type) after the URL address: the URL address changes to: news. asp? Id = 123 '% 2B', the returned page is the same as 1; with '2% 2B 'asdf, the URL address is changed to: news. asp? Id = 123 '% 2 Basdf. The returned page is different from 1, or this record or error is not found. It indicates that there is an injection point, which is text-type. 4. Search-type injection: You can simply search for the existence or absence of a search-type injection vulnerability. If an error occurs, this vulnerability exists in 90%. Then, search for %. If the returned result is normal, there is a hole in 95%. Note: special characters such as "&;", "[", "]", "%", "$", and "@" can be added. If an error occurs, description problematic operation: search for a keyword, such as 2006, and return all 2006-related information normally, search for 2006% and 1 = 1 and '%' = 'and 2006%' and 1 = 2 and '%' = '. If there are similarities and differences, there is a hole in 100%. Keyword % 'and 1 = 1 and' % '=' % keyword % 'and 1 = 2 and' % '=' % replace and 1 = 1 with an injection statement.. determine the database type: and user> 0 for example: showdetail. asp? Id = 49; and user> 0 if it is an ACCESS Database, the "Microsoft JET Database" keyword appears in the returned error, the error message returned for the MSSQL database generally contains "SQL Server. 6. table Name and exists (select * from Table Name) Description: The meaning is the same as above, but the language name is different. 7. to guess the column name and (select count (column name) from Table Name)> 0: if the name of the column we entered is correct, the system returns to the normal page 8. length and (select top 1 len (username) from admin)> 0 Note: if the last bit of data we input returns an error, and the previous digit returns a correct result, it indicates that the length of my guess is correct. 9. guess content and (select top 1 asc (mid (username, 128) from admin)> 50 ascii code 1-Description: if the last bit of data we entered returns an error, if the previous digit is returned correctly, it indicates that the number I guessed is correct. (You can use the half method to guess the content) Half method: half of the difference between the minimum value and the maximum value. For example, if the input is 50, 100 is returned and an error is returned. If the input is half, 75 is input. 10. join query injection (union query) operation steps: 1> Add and 1 = 2 union select * form table names in the background of the normal statement, where * indicates the number of fields, append from 1 (and 1 = 2 union select 1, 2, 3, 4 form table names). If the number of fields is correct, an error occurs. 2> Replace the displayed number with the actual field name, such as username and password. 3> Generate the actual database field value at the field value. 2. Find the background address and log on to the background with the account and password of the user administrator. iii. Upload WEBSHELL methods: 1. upload Vulnerability: If you see: select the file you want to upload [re-upload] or "Please log in and use it", 80% will have the vulnerability! Sometimes the upload may not be successful, because Cookies are different. We need to use WSockExpert to obtain Cookies. Then we need to use DOMAIN upload or Guilin veterans upload tool. 1> upload the files with the vulnerability through upfile. asp. Ease of operation is in upfile_soft.asp. (software Upload Vulnerability) upfile_softpic.asp (Image Upload Vulnerability) is dynamic in uploadflash. asp, upfile_flash.asp, use the packet capture tool to capture packets to get cookies, use the DOMAIN upload or Guilin veteran upload tool 2> Add the upload type asa | asaspp 3> to add a space or a few points after the suffix during uploading, you may be surprised to find that. Example: *. asp, *. asp... 4> upload an image file Trojan and use the backup database to get asp files. 2. cookies can be used to trick websites into understanding you. However, if the cookies are not verified properly, the cookies will be spoofed. Tools used by Guilin veterans for Cookie spoofing. 3.% 5c storm library replace/in the middle of the Level 2 Directory with % 5c EY: otherweb... s. asp? BigClassName = scope of duties &; BigClassType = 1 if you can see: 'e: \ ahttc040901 \ otherweb \ dz \ database \ iXuEr_Studio.asa 'is not a valid path. Check whether the path name is correctly spelled and whether it is connected to the server where the file is stored. This is the database. Replace FLASHGET. MDB format. 4. conn. asp brute-force library is also an old vulnerability, which is of little use value. 'or' = 'or 'universal password login' or '=' or 'is a language that can connect to SQL. you can directly enter the background. I collected it. Similarly, 'or ''='" or "a" = "A') or ('A' = 'a ") or ("a" = "a or 1 = 1 -- 'or 'A' = 'a very old method of exploits, mainly used for some older websites. 6. side note, that is, cross-site. when we intrude into a station, this station may be robust and impeccable. We can find the site with the same server as this station, and then use this Site for Elevation of Privilege, sniffing and other methods to intrude into the websites we want to intrude ., There is a difficulty here, that is, the absolute paths of some servers are encrypted, which depends on our skills. 7. Writing to ASP-format databases. It is a trojan [<% execute request ("value") %>], which is often used in message books. for example, this is an ASP-format database or an ASP file that can be written into the content, such as the System Configuration of the southern data], and then write a Trojan. 8. side note, that is, cross-site. when we intrude into a station, this station may be robust and impeccable. We can find the site with the same server as this station, and then use this Site for Elevation of Privilege, sniffing and other methods to intrude into the websites we want to intrude ., There is a difficulty here, that is, the absolute paths of some servers are encrypted, which depends on our skills. 4. You can use the dvbbs permission escalation tool to improve the permissions of the entire site, make yourself a front-end administrator. THEN: Use the dynamic net fixed top sticker tool to find a fixed top sticker and THEN obtain COOKIES. You need to do this yourself. We can use WSockExpert to get the Cookies/NC package. I will not do this. I will take a look at the next tutorials on the Internet. Tool: dvbbs permission escalation tool dynamic net fixed top paste tool Summary: I personally think that ACCESS website injection is not very flexible, Methods everyone knows, for Chinese websites, you can go to the website to search for programs used by the website. I am also a website. Now, I usually use an existing enterprise website system to modify the website. In the next article, we will sort out the MSSQL injection method. MSSQL injection is flexible and has powerful functions. You can find the injection points, which can be used in general.