Sqli-LABS通关笔录-18-审计SQL注入2-HTTP头注入

 在此关卡我学习到了

1.只要跟数据库交互的多观察几遍。特别是对于http头这种类型的注入方式。

2.

<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
    
function check_input($value)
    {
    if(!empty($value))
        {
        // truncation (see comments)
        $value = substr($value,0,20);
        }

        // Stripslashes if magic quotes enabled
        if (get_magic_quotes_gpc())
            {
            $value = stripslashes($value);
            }

        // Quote if not a number
        if (!ctype_digit($value))
            {
            $value = "'" . mysql_real_escape_string($value) . "'";
            }
        
    else
        {
        $value = intval($value);
        }
    return $value;
    }



    $uagent = $_SERVER['HTTP_USER_AGENT'];   #$_SERVER['HTTP_USER_AGENT']的意思是当前请求的 User_Agent: 头部的内容。 更多$_SERVER详解：http://www.cnblogs.com/xishaonian/p/6160893.html
    $IP = $_SERVER['REMOTE_ADDR']; #当前用户的IP
    echo "<br>";
    echo 'Your IP ADDRESS is: ' .$IP;
    echo "<br>";
    //echo 'Your User Agent is: ' .$uagent;
// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd'])) #判断uname和passwd是否输入了

    {
    $uname = check_input($_POST['uname']);  #使用check_inpuut函数对传过来的uname进行过滤
    $passwd = check_input($_POST['passwd']); #使用check_input函数对传过来的passwd进行过滤
    
    
    echo 'Your Your User name:'. $uname;
    echo "<br>";
    echo 'Your Password:'. $passwd;
    echo "<br>";
    echo 'Your User Agent String:'. $uagent;
    echo "<br>";
    echo 'Your User Agent String:'. $IP;
    

    //logging the connection parameters to a file for analysis.    
    $fp=fopen('result.txt','a');
    fwrite($fp,'User Agent:'.$uname."
");
    
    fclose($fp);
    
    
    
    $sql="SELECT  users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1";
    $result1 = mysql_query($sql);  #执行$sql这一条sql语句。mysql_query是执行mysql的意思。
    $row1 = mysql_fetch_array($result1);
        if($row1)     #如果$row1为真
            {
            echo '<font color= "#FFFF00" font size = 3 >';
            $insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";
            mysql_query($insert);
            //echo 'Your IP ADDRESS is: ' .$IP;
            echo "</font>";
            //echo "<br>";
            echo '<font color= "#0000ff" font size = 3 >';            
            echo 'Your User Agent is: ' .$uagent;
            echo "</font>";
            echo "<br>";
            print_r(mysql_error());            
            echo "<br><br>";
            echo '<img src="../images/flag.jpg"  />';
            echo "<br>";
            
            }
        else
            {
            echo '<font color= "#0000ff" font size="3">';
            //echo "Try again looser";
            print_r(mysql_error());
            echo "</br>";            
            echo "</br>";
            echo '<img src="../images/slap.jpg"   />';    
            echo "</font>";  
            }

    }

?>

 请注意72行。未对传过来的$uagent和$ip做处理就带入了数据库。

THE END

---