-
LOS orgeWebHacking/Load Of Sql Injection 2018. 2. 13. 19:351234567891011121314151617<?phpinclude "./config.php";login_chk();dbconnect();if(preg_match('/prob|_|\.|\(\)/i', $_GET[pw])) exit("No Hack ~_~");if(preg_match('/or|and/i', $_GET[pw])) exit("HeHe");$query = "select id from prob_orge where id='guest' and pw='{$_GET[pw]}'";echo "<hr>query : <strong>{$query}</strong><hr><br>";$result = @mysql_fetch_array(mysql_query($query));if($result['id']) echo "<h2>Hello {$result[id]}</h2>";$_GET[pw] = addslashes($_GET[pw]);$query = "select pw from prob_orge where id='admin' and pw='{$_GET[pw]}'";$result = @mysql_fetch_array(mysql_query($query));if(($result['pw']) && ($result['pw'] == $_GET['pw'])) solve("orge");highlight_file(__FILE__);?>
cs or and를 ||,&&로 연산하고 늘 써왔던 블라인드 sql injection 쿼리문을 그에 맞춰서 이용하면 패스워드를 알아낼수있다.
'WebHacking > Load Of Sql Injection' 카테고리의 다른 글
LOS vampire (0) 2018.02.13 LOS troll (0) 2018.02.13 LOS darkelf (0) 2018.02.13 LOS wolfman (0) 2018.02.13 LOS orc (0) 2018.02.13