Shulou(Shulou.com)06/01 Report--

Injection point:

Http://www..com/shownews.asp?id=471

See if you can inject:

Can not be injected, there is anti-injection system, use tools to break through!

Injection transfer:

To sweep with a tool:

The user name and password are revealed (md5 encryption), then go to the background, decrypt md5 and log in to the background.

Go to the backend, find the website settings, and add the uploaded file type:

Access path: http://XXX.com/UploadFiles/20144221959209.cer, as shown in the following figure, enter the password:

After logging in, as shown in the figure:

Second, manual injection:

Check to see if it can be injected:'1x 1 1m 2

View column length:

Guess the table name: the web page shows that the table exists normally.

Guess table field: the web page shows that the field exists normally.

View display bits:

Burst field content:

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.