sql注入——php源码的审计（以sql-lab 1~15为例）（超详细)

sql注入

sql注入：web应用对用户输入数据的合法性没有判断，并且传入的参数是攻击者可控的，因此攻击者通过构造不同的sql语句来实现对数据库的操作（对数据库的操作：与数据库产生交互都有可能存在，sql注入）

两个关键条件：1. 参数用户可用。2. 参数带入数据库查询
SQL注入根据个人学习所得，大概分为如下几种：

联合查询注入（整型注入、字符型注入、宽字节注入、二次注入、堆叠注入等等）
报错注入（通过报错函数大致分为updatexml报错注入、floor报错注入、extractvalue报错注入、exp报错注入等等）
盲注（时间型盲注、布尔型盲注等等）

通过我们的上传点位置还大致分为GET注入、POST注入、http头部注入等等。

现在我们就开始sql的代码审计吧：

Less-1

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-1 **Error Based- String**</title>
</head><body bgcolor="#000000">
<div style=" margin-top:70px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}else {echo '<font color= "#FFFF00">';print_r(mysql_error());echo "</font>";  }
}else { echo "Please input the ID as parameter with numeric value";}?>
</font> </div></br></br></br><center>
<img src="../images/Less-1.jpg" /></center>
</body>
</html>

在源码审计之前我们要先了解一下php函数的作用：

error_reporting(0)

error_reporting(0)函数规定不同的错误级别的报告

<?php// 关闭错误报告error_reporting(0);
?>

include("../sql-connections/sql-connect.php");

include 表达式包含并运行指定文件。

if(isset($_GET['id']))

if 语句用于在指定条件为 true 时执行代码(与c语言，python相同)

isset($_GET['id'])

isset() 函数用于检测变量是否已设置并且非 NULL。

如果已经使用 unset() 释放了一个变量之后，再通过 isset() 判断将返回 FALSE。

若使用 isset() 测试一个被设置成 NULL 的变量，将返回 FALSE。

同时要注意的是 null 字符（"\0"）并不等同于 PHP 的 NULL 常量。

$id=$_GET['id'];   // 将$_GET['id']赋值给$id

$id= 是php的变量函数

fopen('result.txt','a');

fopen() 函数打开文件或者 URL。

如果打开失败，本函数返回 FALS

该函数语法：

fopen(filename,mode,include_path,context)

fwrite($fp,'ID:'.$id."\n");

fwrite() 函数写入文件

语法：

fwrite(file,string,length)

fclose($fp);

fclose() 函数关闭一个打开文件。

mysql_query($sql)

mysql_query() 函数执行一条 MySQL 查询

mysql_fetch_array($result);

mysql_fetch_array() 函数从结果集中取得一行作为关联数组，或数字数组，或二者兼有

返回根据从结果集取得的行生成的数组，如果没有更多行则返回 false。

 echo "<font size='5' color= '#99FF00'>";

echo 输出文本

eg:

<?php
echo "Hello world!";
?>    // 输出   hello world

print_r(mysql_error());

print_r：函数用于打印变量（相当于c语言中的printf python中的print）

mysql_error：mysql_error() 函数返回上一个 MySQL 操作产生的文本错误信息。本函数返回上一个 MySQL 函数的错误文本，如果没有出错则返回 ‘’（空字符串）。

源码讲解：

现在我们已经了解完源码的全部原函数，让我们开始源码审计吧：

由源码看出我们在网页上直接进行GET上传

$id=$_GET['id'];

并且可以发现：

它的sql变量可以直接到sql语句中查询

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

从数据库中获取的内容可以直接在页面上显示：

 if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}

less-2

源码如下:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-2 **Error Based- Intiger**</title>
</head><body bgcolor="#000000"><div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}else {echo '<font color= "#FFFF00">';print_r(mysql_error());echo "</font>";  }
}else{  echo "Please input the ID as parameter with numeric value";}?></font> </div></br></br></br><center>
<img src="../images/Less-2.jpg" /></center>
</body>
</html>

经过观察发现：less-1与less-2的源码一摸一样

源码分析请参考上一关。

less-3

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-3 Error Based- String (with Twist) </title></head><body bgcolor="#000000"><div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}else

代码讲解

第三关的原码与第一关的源码相差不大

仅仅只是此处发生变化：

$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";

我们不难发先，第三关只是id的包裹方式发生变化由第一关的 ‘id’ 变为 (’$id’)

所以，其余与less-1 和 less-2一样

由源码看出我们在网页上直接进行GET上传

$id=$_GET['id'];

并且可以发现：

它的sql变量可以直接到sql语句中查询

$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";

从数据库中获取的内容可以直接在页面上显示：

 if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}

less-4

源码

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-4 Error Based- DoubleQuotes String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $id = '"' . $id . '"';
$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}else {echo '<font color= "#FFFF00">';print_r(mysql_error());echo "</font>";  }
}else { echo "Please input the ID as parameter with numeric value";}?></font> </div></br></br></br><center>
<img src="../images/Less-4.jpg" /></center>
</body>
</html>

与第三关相同仅仅只是包裹方式的不同

$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";

从上面的源代码看出包裹方式变为($id)

所以，其余与less-1 和 less-2一样

由源码看出我们在网页上直接进行GET上传

$id=$_GET['id'];

并且可以发现：

它的sql变量可以直接到sql语句中查询

$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";

从数据库中获取的内容可以直接在页面上显示：

 if($row){echo "<font size='5' color= '#99FF00'>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "</font>";}

less-5

源码

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-5 Double Query- Single Quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';   echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="3" color="#FFFF00">';print_r(mysql_error());echo "</br></font>"; echo '<font color= "#0000ff" font size= 3>';    }
}else { echo "Please input the ID as parameter with numeric value";}?></font> </div></br></br></br><center>
<img src="../images/Less-5.jpg" /></center>
</body>
</html>

源码审计：

通过对比前面关卡的源码，我们发现第五关的源码少了

$result=mysql_query($sql);$row = mysql_fetch_array($result);echo 'Your Login name:'. $row['username'];echo 'Your Password:' .$row['password'];

这代表着在数据库中获取的内容无法直接展示，不过代码中有这么一行代码，回显了数据库的报错数据；

echo '<font size="3" color="#FFFF00">';print_r(mysql_error());echo "</br></font>";   echo '<font color= "#0000ff" font size= 3>';

因此，我们可以很自然的想到上文中提到的报错注入：updatexml（具体如何报错，请关注我的相关博客）

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

有这条源码我们可以发现他的包裹方式为：’$id’

less-6

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-6 Double Query- Double Quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';   echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="3"  color= "#FFFF00">';print_r(mysql_error());echo "</br></font>";   echo '<font color= "#0000ff" font size= 3>';    }
}else { echo "Please input the ID as parameter with numeric value";}?>
</font> </div></br></br></br><center>
<img src="../images/Less-6.jpg" /></center>
</body>
</html>

通过观察发现：less-6与less-5的源码及其的相似

都只有

echo '<font size="3" color="#FFFF00">';print_r(mysql_error());echo "</br></font>";   echo '<font color= "#0000ff" font size= 3>';

都无法在在数据库中获取的内容无法直接展示，只能进行报错注入

仅仅只是包裹方式不同：

$id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

less-7

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-7 Dump into Outfile</title></head><body bgcolor="#000000"><div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id=(('$id')) LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font color= "#FFFF00">';  echo 'You are in.... Use outfile......';echo "<br>";echo "</font>";}else {echo '<font color= "#FFFF00">';echo 'You have an error in your SQL syntax';//print_r(mysql_error());echo "</font>";  }
}else { echo "Please input the ID as parameter with numeric value";}?>
</font> </div></br></br></br><center>
<img src="../images/Less-7.jpg" /></center>
</body>

源码分析：

相比于less-5的源码，我们发现less-7的源码少了：

 print_r(mysql_error());

表示less-7无法进行数据库报错数据的回显，代表着上面机关用的updatexml的报错回显的方法已经无法使用，

并且在less-7中也给了我们相关的提示：

     echo 'You are in.... Use outfile......';

在上一关中的回显中是一个“You are in…”，不过这一关中的源码很明显将输出数据库错误的代码进行了一个注释（页面正确和错误的显示不同），而且在上面都有一个isset函数对文件夹进行一个输入，从而实现了了对错的比较。

这时候我们就因该想到使用罗尔盲注的手法了。（罗尔盲注的用法，可以看我相关的博客）

less-8

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-8 Blind- Boolian- Single Quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';   echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="5" color="#FFFF00">';//echo 'You are in...........';//print_r(mysql_error());//echo "You have an error in your SQL syntax";echo "</br></font>";  echo '<font color= "#0000ff" font size= 3>';    }
}else { echo "Please input the ID as parameter with numeric value";}?></font> </div></br></br></br><center>
<img src="../images/Less-8.jpg" /></center>
</body>
</html>

源码分析：

通过对比发现 less-7和leaa-8的源码相差不大,都没有

print_r(mysql_error());

都无法进行一个报错注入，只能进行盲注。

仅仅只是一个包裹的不同

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

less-9

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-9 Blind- Time based- Single Quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';   echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="5" color="#FFFF00">';echo 'You are in...........';//print_r(mysql_error());//echo "You have an error in your SQL syntax";echo "</br></font>";    echo '<font color= "#0000ff" font size= 3>';    }
}else { echo "Please input the ID as parameter with numeric value";}?>

源码审计：

观察源码我们发现：

else {echo '<font size="5" color="#FFFF00">';echo 'You are in...........';//print_r(mysql_error());//echo "You have an error in your SQL syntax";echo "</br></font>";    echo '<font color= "#0000ff" font size= 3>';    }

这一关的对于错的回显是一样的，所以上几关使用的布尔盲注我们已经无法在使用了。这时候，我们只能使用最后的法宝：时间盲注（时间盲注的用法，可以看我相关的博客）。

less-10

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>Less-10 Blind- Time based- Double Quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:60px;color:#FFF; font-size:23px; text-align:center">Welcome&nbsp;&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br>
<font size="3" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_GET['id']))
{$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);// connectivity $id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);if($row){echo '<font size="5" color="#FFFF00">';   echo 'You are in...........';echo "<br>";echo "</font>";}else {echo '<font size="5" color="#FFFF00">';echo 'You are in...........';//print_r(mysql_error());//echo "You have an error in your SQL syntax";echo "</br></font>";    echo '<font color= "#0000ff" font size= 3>';    }
}else { echo "Please input the ID as parameter with numeric value";}?>
</font> </div></br></br></br><center>
<img src="../images/Less-10.jpg" /></center>
</body>
</html>

源码分析：

通过对比less-9和less-10 我们发现他们的源码相差不大，仅仅只是包裹方式不同

$id = '"'.$id.'"';
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";

less-11

源码

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-11- Error Based- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:20px;color:#FFF; font-size:24px; text-align:center"> Welcome&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br></div><div  align="center" style="margin:40px 0px 0px 520px;border:20px; background-color:#0CF; text-align:center; width:400px; height:150px;"><div style="padding-top:10px; font-size:15px;"><!--Form to post the data for sql injections Error based SQL Injection-->
<form action="" name="form1" method="post"><div style="margin-top:15px; height:30px;">Username : &nbsp;&nbsp;&nbsp;<input type="text"  name="uname" value=""/></div>  <div> Password  : &nbsp;&nbsp;&nbsp;<input type="text" name="passwd" value=""/></div></br><div style=" margin-top:9px;margin-left:90px;"><input type="submit" name="submit" value="Submit" /></div>
</form></div></div><div style=" margin-top:10px;color:#FFF; font-size:23px; text-align:center">
<font size="6" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname);fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';   echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in\n\n " ;echo '<font size="3" color="#0000ff">';    echo "<br>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"  />';   echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg" />'; echo "</font>";  }
}?></font>
</div>
</body>
</html>

源码审计：

观察less-11源码我们发现这道题和之前10关的传输方式不同，为post传参

在PHP部分和less-1的源代码相似:

它的sql变量可以直接到sql语句中查询

@$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";

从数据库中获取的内容可以直接在页面上显示：

echo '<font size="3" color="#0000ff">';    echo "<br>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"  />';   echo "</font>";}

所以我们可以直接使用联合传参的方式。（和less-1的方法相同）

less-12

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-12- Error Based- Double quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:20px;color:#FFF; font-size:24px; text-align:center"> Welcome&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br></div><div  align="center" style="margin:40px 0px 0px 520px;border:20px; background-color:#0CF; text-align:center; width:400px; height:150px;"><div style="padding-top:10px; font-size:15px;"><!--Form to post the data for sql injections Error based SQL Injection-->
<form action="" name="form1" method="post"><div style="margin-top:15px; height:30px;">Username : &nbsp;&nbsp;&nbsp;<input type="text"  name="uname" value=""/></div>  <div> Password  : &nbsp;&nbsp;&nbsp;<input type="text" name="passwd" value=""/></div></br><div style=" margin-top:9px;margin-left:90px;"><input type="submit" name="submit" value="Submit" /></div>
</form></div></div><div style=" margin-top:10px;color:#FFF; font-size:23px; text-align:center">
<font size="6" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname."\n");fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity$uname='"'.$uname.'"';$passwd='"'.$passwd.'"'; @$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';    echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in " ;echo '<font size="3" color="#0000ff">';    echo "<br>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"   />';  echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"   />';   echo "</font>";  }
}?></font>
</div>
</body>
</html>

源码审计：

通过对比我们发现less-11和less-12相似，都使用post传参，仅仅只是包裹方式不同

$uname='"'.$uname.'"';$passwd='"'.$passwd.'"'; @$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";

less-13

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-13- Double Injection- String- with twist</title>
</head><body bgcolor="#000000">
<div style=" margin-top:20px;color:#FFF; font-size:24px; text-align:center"> Welcome&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br></div><div  align="center" style="margin:40px 0px 0px 520px;border:20px; background-color:#0CF; text-align:center; width:400px; height:150px;"><div style="padding-top:10px; font-size:15px;"><!--Form to post the data for sql injections Error based SQL Injection-->
<form action="" name="form1" method="post"><div style="margin-top:15px; height:30px;">Username : &nbsp;&nbsp;&nbsp;<input type="text"  name="uname" value=""/></div>  <div> Password  : &nbsp;&nbsp;&nbsp;<input type="text" name="passwd" value=""/></div></br><div style=" margin-top:9px;margin-left:90px;"><input type="submit" name="submit" value="Submit" /></div>
</form></div></div><div style=" margin-top:10px;color:#FFF; font-size:23px; text-align:center">
<font size="6" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname."\n");fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity @$sql="SELECT username, password FROM users WHERE username=('$uname') and password=('$passwd') LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';    echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in " ;echo '<font size="3" color="#0000ff">';    echo "<br>";//echo 'Your Login name:'. $row['username'];//echo "<br>";//echo 'Your Password:' .$row['password'];//echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"   />';  echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"   />';   echo "</font>";  }
}?></font>
</div>
</body>
</html>

源码分析：

通过对比我们不难发现，less-13少了：

echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in " ;echo '<font size="3" color="#0000ff">'; echo "<br>";echo 'Your Login name:'. $row['username'];echo "<br>";echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"   />';  echo "</font>";

这代表着在数据库中获取的内容无法直接展示，不过代码中有这么一行代码，回显了数据库的报错数据；

 print_r(mysql_error());

回想less-5的做法我们自然而然的使用updatexml的报错手法；

最后一定要记得观察 id 的包裹手法：

@$sql="SELECT username, password FROM users WHERE username=('$uname') and password=('$passwd') LIMIT 0,1";

less-14

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-14- Double Injection- Double quotes- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:20px;color:#FFF; font-size:24px; text-align:center"> Welcome&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br></div><div  align="center" style="margin:40px 0px 0px 520px;border:20px; background-color:#0CF; text-align:center; width:400px; height:150px;"><div style="padding-top:10px; font-size:15px;"><!--Form to post the data for sql injections Error based SQL Injection-->
<form action="" name="form1" method="post"><div style="margin-top:15px; height:30px;">Username : &nbsp;&nbsp;&nbsp;<input type="text"  name="uname" value=""/></div>  <div> Password  : &nbsp;&nbsp;&nbsp;<input type="text" name="passwd" value=""/></div></br><div style=" margin-top:9px;margin-left:90px;"><input type="submit" name="submit" value="Submit" /></div>
</form></div></div><div style=" margin-top:10px;color:#FFF; font-size:23px; text-align:center">
<font size="6" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname."\n");fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity$uname='"'.$uname.'"';$passwd='"'.$passwd.'"'; @$sql="SELECT username, password FROM users WHERE username=$uname and password=$passwd LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';    echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in " ;echo '<font size="3" color="#0000ff">';    echo "<br>";//echo 'Your Login name:'. $row['username'];//echo "<br>";//echo 'Your Password:' .$row['password'];//echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg" />';    echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"  />';    echo "</font>";  }
}?></font>
</div>
</body>
</html>

源码审计：

观察发现：

less-14 和 less-15 的区别不大，仅仅只是包裹手法的不同：

 $uname='"'.$uname.'"';$passwd='"'.$passwd.'"'; @$sql="SELECT username, password FROM users WHERE username=$uname and password=$passwd LIMIT 0,1";

less-15

源码如下：

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>Less-15- Blind- Boolian Based- String</title>
</head><body bgcolor="#000000">
<div style=" margin-top:20px;color:#FFF; font-size:24px; text-align:center"> Welcome&nbsp;&nbsp;<font color="#FF0000"> Dhakkan </font><br></div><div  align="center" style="margin:40px 0px 0px 520px;border:20px; background-color:#0CF; text-align:center; width:400px; height:150px;"><div style="padding-top:10px; font-size:15px;"><!--Form to post the data for sql injections Error based SQL Injection-->
<form action="" name="form1" method="post"><div style="margin-top:15px; height:30px;">Username : &nbsp;&nbsp;&nbsp;<input type="text"  name="uname" value=""/></div>  <div> Password  : &nbsp;&nbsp;&nbsp;<input type="text" name="passwd" value=""/></div></br><div style=" margin-top:9px;margin-left:90px;"><input type="submit" name="submit" value="Submit" /></div>
</form></div></div><div style=" margin-top:10px;color:#FFF; font-size:23px; text-align:center">
<font size="6" color="#FFFF00"><?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))
{$uname=$_POST['uname'];$passwd=$_POST['passwd'];//logging the connection parameters to a file for analysis.$fp=fopen('result.txt','a');fwrite($fp,'User Name:'.$uname);fwrite($fp,'Password:'.$passwd."\n");fclose($fp);// connectivity @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";$result=mysql_query($sql);$row = mysql_fetch_array($result);if($row){//echo '<font color= "#0000ff">';   echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in\n\n " ;echo '<font size="3" color="#0000ff">';    echo "<br>";//echo 'Your Login name:'. $row['username'];echo "<br>";//echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"  />';   echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";//print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"   />'; echo "</font>";  }
}?></font>
</div>
</body>
</html>

源码审计：

相比于less-13的不同less-15它少了：

 print_r(mysql_error());

并且观察源码我们发现，当我们输入时，页面显示正确和错误的样子不同：

if($row){//echo '<font color= "#0000ff">';    echo "<br>";echo '<font color= "#FFFF00" font size = 4>';//echo " You Have successfully logged in\n\n " ;echo '<font size="3" color="#0000ff">';    echo "<br>";//echo 'Your Login name:'. $row['username'];echo "<br>";//echo 'Your Password:' .$row['password'];echo "<br>";echo "</font>";echo "<br>";echo "<br>";echo '<img src="../images/flag.jpg"  />';   echo "</font>";}else  {echo '<font color= "#0000ff" font size="3">';//echo "Try again looser";//print_r(mysql_error());echo "</br>";echo "</br>";echo "</br>";echo '<img src="../images/slap.jpg"   />'; echo "</font>";  }

联想到第七关我们决定使用布尔盲注。

最后观察包裹方式：

 @$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";

注意：

如果有小伙伴已经做了less-15就会发现：

less-9的输入为：

解析库名长度：  ?id=1' and if(length(database())=8,sleep(5),1)-- q解析数据库名称：?id=1' and if((ascii(substr(database(),1,1))=115),sleep(5),1)-- q解析表名： ?id=1' and if((ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101),sleep(5),1)-- q  解析字段名：?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),1,1))=105),sleep(5),1)-- q

less-15的输入为

判断数据库长度：'or (length(database()))=8-- q判断数据库名字：'or (ascii(substr(database(),1,1)))=115-- q判断表的名字：'or (ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1)))=101-- q判断列的名字:'or (ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),1,1)))=105-- q

就会有这样一个疑惑：为啥，九关为 and 是十五关为 or

让我们来观察下源码：

less-9：

$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";

less-15：

@$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";

观察这两句源代码，不难看出如果我们使用 and 就会变成：

@$sql="SELECT username, password FROM users WHERE username='$uname' 'or (length(database()))=8-- q and password='$passwd' LIMIT 0,1";

显然不成立，因为我们不清楚username的值。如果使用or，那么后面的值成立就整体成立。而在9题中 id=1 是成立的所以可以使用and来作为语句的连接。