×î½ü·¢Ã÷Ðí¶à¸Õ½Ó´¥Éø͸·½ÃæµÄСͬ°é¶¼²»ÖªµÀʵսÍÚ¾òÎó²îµÄ¾÷ÇÏ£¬£¬£¬£¬£¬ÓÚÊÇÎÒÍýÏëдһЩ×Ô¼ºÍÚÎó²îµÄ¾÷ÇÏ¡£¡£¡£¡£

srcÍƼöÐÂÊÖÍÚ¶´Ê×Ñ¡Îó²îºÐ×Ó£¬£¬£¬£¬£¬ÓÉÓÚÎó²îºÐ×Ó¹æÄ£¹ã£¬£¬£¬£¬£¬º£ÄÚµÄÕ¾µã¶¼ÊÕ¡£¡£¡£¡£Ïà±ÈÓÚÆäËûsrcƽ̨£¬£¬£¬£¬£¬ÍÚ¾òÆñ·ÇºÜÊʺÏÐÂÊÖ¡£¡£¡£¡£

Îó²îÍÚ¾ò£¬£¬£¬£¬£¬ÐÅÏ¢ÍøÂçºÜÖ÷Òª¡£¡£¡£¡£

ÕâÀïÒÔ²¿·ÖʵսÕö¿ª½â˵¡£¡£¡£¡£

Ê×ÏÈ˵һϹȸèÓï·¨°É £¡£¡£¡£¡£¡£¡£¡£¡£¡

ÈçÏ¿Éͨ¹ýfofa¡¢ÖÓظ֮ÑÛ¡¢shodanµÈÍøÂç¿Õ¼äËÑË÷ÒýÇæËÑË÷Google¾µÏñ¡£¡£¡£¡£

# SQL×¢ÈëÍÚ¶´»ù±¾Á÷ͨ

1.ÕÒÎó²î£¬£¬£¬£¬£¬Í¨¹ý»ù±¾µÄsite:¡¢inurl:¹È¸èÓï·¨¡£¡£¡£¡£

2.ÕÒµ½Ò»¸öÕ¾µã£¬£¬£¬£¬£¬ÖÖÖÖµãµãµã£¬£¬£¬£¬£¬ÕÒËûµÄ×¢Èëµã¡£¡£¡£¡£

3.ÕÒ²»µ½×¢Èëµã£¬£¬£¬£¬£¬ÐÅÏ¢ÍøÂç¡£¡£¡£¡£

4.È»ºó¾ÍÊÇһЩÁвÙ×÷¡£¡£¡£¡£

·­¿ªGoogle¾µÏñ£¬£¬£¬£¬£¬ÊäÈëׯÏÐÓÎÏ·¹È¸èÓï·¨site:.com ¹«Ë¾¡£¡£¡£¡£

ÕâÑù¾Í»áµÃ³öÓòÃûÒÔ.comΪºó׺Ïà¹ØµÄ¹«Ë¾Ãû³Æ£¬£¬£¬£¬£¬ÔÚºóÃæ¼Ó¸ö¹«Ë¾µÄÒâÒå¾ÍÊÇÖ¸¶¨Îª¹«Ë¾Ãû³Æɸѡ¡£¡£¡£¡£

¹È¸èÓï·¨£¬£¬£¬£¬£¬Í¨¹ý¹È¸èä¯ÀÀÆ÷ËÑË÷£ºsite:.com inurl:php?id=22 ¹«Ë¾

ÕâÀï¼ÓÉÏÁËphp?id=22£¬£¬£¬£¬£¬ÓÉÓÚÔÛÃǵÄ×¢Èëµã½¹µãÔÚÓÚ´«²Î£¬£¬£¬£¬£¬ÒÔÊÇËÑË÷´«²Î»áÔ½·¢ÈÝÒ×ÕÒµ½Îó²î¡£¡£¡£¡£

ÏÂÃæÎÒÃÇÕÒµ½Ò»¸öÍøÕ¾¾ÙÐвâÊÔ¡£¡£¡£¡£

Ê×ÏÈÎÒÃÇÊäÈëµ¥ÒýºÅ: ' £¬£¬£¬£¬£¬¿´Ò³Ã汬·¢ÁËת±ä¡£¡£¡£¡£

Õâ˵Ã÷ÎÒÃÇÊäÈëµÄµ¥ÒýºÅ±»Ö´ÐУ¬£¬£¬£¬£¬±¬·¢Á˱¨´í¡£¡£¡£¡£ÕâÀï¾Í¼«´ó¿ÉÄܱ£´æSQL×¢Èë¡£¡£¡£¡£

½øÒ»²½Ê¹Ó㬣¬£¬£¬£¬and 1=1 && and 1=2,¾ÙÐÐÑéÖ¤Îó²îÊÇ·ñ±£´æ¡£¡£¡£¡£

ÕâÀïµÄand 1=1£¬£¬£¬£¬£¬Ò³ÃæÕý³££¬£¬£¬£¬£¬µ«ÔÚ and 1=2 µÄʱ¼ä£¬£¬£¬£¬£¬Ò³ÃæÒ²ÊÇ»ØÏÔÕý³££¬£¬£¬£¬£¬½øÒ»²½ÑéÖ¤¡£¡£¡£¡£

ÎÒÃǼÌÐøʹÓÃSQLÓï¾äº¯Êý£¬£¬£¬£¬£¬µÃ³ö½áÂÛ£¬£¬£¬£¬£¬ÎÒÃDZ»ÍøÕ¾·À»ðǽ×èµ²ÁË¡£¡£¡£¡£

ûÈƹýÍøÕ¾·À»ðǽ£¬£¬£¬£¬£¬ÕâÀïËæ±ãÊÔÁËÒ»ÏÂÄÚÁª×¢ÊÍ·¨£¬£¬£¬£¬£¬Ö´ÐÐÀÖ³ÉÁË¡£¡£¡£¡£ÈÆ·À»ðǽ̫·±Ëö£¬£¬£¬£¬£¬ÎÒ¾Í×ö¶à²Ù×÷ÁË£¬£¬£¬£¬£¬¹ØÓÚÐÂÊÖÀ´Ëµ£¬£¬£¬£¬£¬Óöµ½·À»ðǽ¿ÉÒÔÖ±½ÓÍËÈ´ÁË¡£¡£¡£¡£

ÏÂÃæÕÒµ½Ò»¸öÕ¾£¬£¬£¬£¬£¬ÊäÈëµ¥ÒýºÅ',Ò³ÃæÒì³££¬£¬£¬£¬£¬ÎÒÃÇÕÒÊäÈëand 1=1 | 1=2£¬£¬£¬£¬£¬·¢Ã÷1=2Òì³£¡£¡£¡£¡£

˵Ã÷ÎÒÃÇÊäÈëµÄº¯Êý±»Êý¾Ý¿âÖ´ÐУ¬£¬£¬£¬£¬±£´æSQL×¢Èë¡£¡£¡£¡£

ÒѾ­²âÊÔÎó²î´æ£¬£¬£¬£¬£¬½ÓÏÂÀ´¿´ÄÜ·ñÑéÖ¤Îó²î¡£¡£¡£¡£ÉÏSQLÓï¾ä£¬£¬£¬£¬£¬ÎÒÃÇʹÓÃorder by 11 | order by 12¡£¡£¡£¡£

order by 11 Ò³ÃæÕý³££¬£¬£¬£¬£¬¶øorder by 12 Ò³ÃæÒì³££¨ËµÃ÷±£´æ11¸ö×ֶΣ©¡£¡£¡£¡£

È»ºóÎÒÃÇÔËÓÃSQLÓï¾ä£¬£¬£¬£¬£¬·¢Ã÷ÕâÀï±£´æ²¼¶ûäע£¬£¬£¬£¬£¬²¼¶ûäעÅÌÎÊÊý¾Ý·±Ëö£¬£¬£¬£¬£¬ÕâÀïÖ±½Ó¶ªSQLmapÅÜÁË¡£¡£¡£¡£

sqlmapÏÂÁPython sqlmap.py -u Ä¿µÄURL --dbs£¨Ö¸¶¨Ä¿µÄÅÜ¿âÃû£©£¬£¬£¬£¬£¬×îºóÀֳɵóö¿âÃû¡£¡£¡£¡£

ÍÚ¶´¾ÍÊÇÕâôµÄÇáÇáËÉËÉ£¬£¬£¬£¬£¬SQL×¢ÈëÕÕ¾ÉÌØÊâ¶àµÄ£¬£¬£¬£¬£¬Óöµ½waf£¬£¬£¬£¬£¬ÓÐÏë·¨µÄ¿ÉÒÔȥʵÑéÈƹý¡£¡£¡£¡£

XSSÎó²î

Ò»Ñùƽ³£Í¨¹ýËÑË÷µ½µÄÕ¾µã¿´ÊÇ·ñÓÐÁôÑ԰壬£¬£¬£¬£¬¿ÉÒÔʵÑéä´òXSS£¬£¬£¬£¬£¬Ò»Ñùƽ³£Ò»¸öXSSΪÖÐΣ£¬£¬£¬£¬£¬Ö±½Ó¹¹½¨xssÓï¾ä£º<script>alert(1)</script>,¼û¿òÖ±½Ó²å¾ÍÐÐÁË£¬£¬£¬£¬£¬µ¯´°¾ÍÖ±½ÓÌá½»srcƽ̨¾ÍÐÐÁË¡£¡£¡£¡£

XSSÒ»Ñùƽ³£ÁôÑ԰壡£¡£¡£¡£¡£¡£¡£¡£¡

Èõ¿ÚÁîÎó²îÍÚ¾ò

Èõ¿ÚÁîµÄ¹È¸èÓï·¨£ºinurl:admin/login.php ¹«Ë¾¡£¡£¡£¡£

ÕâÑù¾Í¿ÉÒÔËѵ½Ðí¶à¹«Ë¾µÄºǫ́¿©¡£¡£¡£¡£

½øÈëºǫ́¿ÉÒÔʹÓù¤¾ßÅúÁ¿È¥±¬ÆÆÈõ¿ÚÁîÁË£¬£¬£¬£¬£¬Èçadmin/111111µÈ,»¹¿ÉÒÔͨ¹ýÉó²éjs´úÂëÉó²éÊÇ·ñÓб£´æÕ˺ÅÃÜÂë¡£¡£¡£¡£

¿ÉÒÔȥʹÓûò×Ô¼º¹¹½¨Èõ¿ÚÁÆƹ¤¾ß£¬£¬£¬£¬£¬ÕâÖÖ¹¤¾ßÌØÊâ¶à£¬£¬£¬£¬£¬¾Íδ¼¸ÐðÊöÁË¡£¡£¡£¡£

ÓеÄÑéÖ¤Âë¾ÍÊÇ°²ÅŵÄ£¬£¬£¬£¬£¬Ò²ÓÐ׽ס°ü¾Í²»»áת±äµÄÑéÖ¤Âë¡£¡£¡£¡£

ÕâЩ¶¼ÊÇÍÚ¾òsrc½ÏÁ¿ÍƼöµÄÎó²î£¬£¬£¬£¬£¬×£¸÷ÈËÔçÈÕµÇÉÏ°ñ×ø£¡£¡£¡£¡£¡£¡£¡£¡£¡

¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª¡ª

×÷ÕߣºÒ»ºôyyds

Ô­ÎÄÁ´½Ó£ºhttps://blog.csdn.net/m0_65606241/article/details/124673704