- 贴一个比较有用的SQl注入的FUZZ字典
- 每次遇到过滤都是一个一个尝试的,一直没有使用过,因为之前的字典奇奇怪怪的一点用都没有
- 后面找到了好的ssti和代码执行的fuzz字典也贴在这里,使用方法都是一样的
使用方法
-
先得找到注入点,抓包发送到爆破模块,在注入点处正常添加变量并且爆破即可
-
在字典处导入本地字典,在线程处创建新的爆破速度,500毫秒差不多了
- 观察被过滤后和被过滤前的页面有什么不同,是返回长度还是相应时间,比如极客大挑战2019的hardsql就是长度变短
- 显然,长度为736的是被过滤了,长度为751的没有过滤
- 以往超级难测试的过滤现在两下跑出来了
字典内容
length
Length
+
handler
like
LiKe
select
SeleCT
sleep
SLEEp
database
DATABASe
delete
having
or
oR
as
As
-~
BENCHMARK
limit
LimIt
left
Left
select
SELECT
insert
insERT
INSERT
right
#
--+
INFORMATION
--
;
!
%
+
xor
<>
(
>
<
)
.
^
=
AND
ANd
BY
By
CAST
COLUMN
COlumn
COUNT
Count
CREATE
END
case
'1'='1
when
admin'
"
length
+
REVERSE
ascii
ASSIC
ASSic
select
database
left
right
union
UNIon
UNION
"
&
&&
||
oorr
/
//
//*
*/*
/**/
anandd
GROUP
HAVING
IF
INTO
JOIN
LEAVE
LEFT
LEVEL
sleep
LIKE
NAMES
NEXT
NULL
OF
ON
|
infromation_schema
user
OR
ORDER
ORD
SCHEMA
SELECT
SET
TABLE
THEN
UNION
UPDATE
USER
USING
VALUE
VALUES
WHEN
WHERE
ADD
AND
prepare
set
update
delete
drop
inset
CAST
COLUMN
CONCAT
GROUP_CONCAT
group_concat
CREATE
DATABASE
DATABASES
alter
DELETE
DROP
floor
rand()
information_schema.tables
TABLE_SCHEMA
%df
concat_ws()
concat
LIMIT
ORD
ON
extractvalue
order
CAST()
by
ORDER
OUTFILE
RENAME
REPLACE
SCHEMA
SELECT
SET
updatexml
SHOW
SQL
TABLE
THEN
TRUE
instr
benchmark
format
bin
substring
ord
UPDATE
VALUES
VARCHAR
VERSION
WHEN
WHERE
/*
`
,
users
%0a
%0A
%0b
mid
for
BEFORE
REGEXP
RLIKE
in
sys schemma
SEPARATOR
XOR
CURSOR
FLOOR
sys.schema_table_statistics_with_buffer
INFILE
count
%0c
from
%0d
%a0
=
@
else
%27
%23
%22
%20