Sqli-LABS通关笔录-18-审计SQL注入2-HTTP头注入

 在此关卡我学习到了

1.只要跟数据库交互的多观察几遍。特别是对于http头这种类型的注入方式。

2.

 <?php
 //including the Mysql connect parameters.
 include("../sql-connections/sql-connect.php");
 error_reporting();

 function check_input($value)
     {
     if(!empty($value))
         {
         // truncation (see comments)
         $value = substr($value,,);
         }

         // Stripslashes if magic quotes enabled
         if (get_magic_quotes_gpc())
             {
             $value = stripslashes($value);
             }

         // Quote if not a number
         if (!ctype_digit($value))
             {
             $value = "'" . mysql_real_escape_string($value) . "'";
             }

     else
         {
         $value = intval($value);
         }
     return $value;
     }

     $uagent = $_SERVER['HTTP_USER_AGENT'];   #$_SERVER['HTTP_USER_AGENT']的意思是当前请求的 User_Agent: 头部的内容。 更多$_SERVER详解：http://www.cnblogs.com/xishaonian/p/6160893.html     $IP = $_SERVER['REMOTE_ADDR']; #当前用户的IP
     echo "<br>";
     echo 'Your IP ADDRESS is: ' .$IP;
     echo "<br>";
     //echo 'Your User Agent is: ' .$uagent;
 // take the variables
 if(isset($_POST['uname']) && isset($_POST['passwd'])) #判断uname和passwd是否输入了

     {
     $uname = check_input($_POST['uname']);  #使用check_inpuut函数对传过来的uname进行过滤
     $passwd = check_input($_POST['passwd']); #使用check_input函数对传过来的passwd进行过滤

     echo 'Your Your User name:'. $uname;
     echo "<br>";
     echo 'Your Password:'. $passwd;
     echo "<br>";
     echo 'Your User Agent String:'. $uagent;
     echo "<br>";
     echo 'Your User Agent String:'. $IP;

     //logging the connection parameters to a file for analysis.
     $fp=fopen('result.txt','a');
     fwrite($fp,'User Agent:'.$uname."\n");

     fclose($fp);

     $sql="SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
     $result1 = mysql_query($sql);  #执行$sql这一条sql语句。mysql_query是执行mysql的意思。
     $row1 = mysql_fetch_array($result1);
         if($row1)     #如果$row1为真
             {
             echo '<font color= "#FFFF00" font size = 3 >';
             $insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";
             mysql_query($insert);
             //echo 'Your IP ADDRESS is: ' .$IP;
             echo "</font>";
             //echo "<br>";
             echo '<font color= "#0000ff" font size = 3 >';
             echo 'Your User Agent is: ' .$uagent;
             echo "</font>";
             echo "<br>";
             print_r(mysql_error());
             echo "<br><br>";
             echo '<img src="../images/flag.jpg"  />';
             echo "<br>";

             }
         else
             {
             echo '<font color= "#0000ff" font size="3">';
             //echo "Try again looser";
             print_r(mysql_error());
             echo "</br>";
             echo "</br>";
             echo '<img src="../images/slap.jpg"   />';
             echo "</font>";
             }

     }

 ?>

请注意72行。未对传过来的$uagent和$ip做处理就带入了数据库。

THE END

---