延时注入

1. 普通写法

  • 单纯判断是否有漏洞，但存在网络波动的可能性
id: base  
info:  
  name: base   
  author: msk  
  description: 描述漏洞基本情况  
  severity: info 漏洞等级    
  tags: detect 标签  
  
http:  
  - raw:      
    - |        
      GET /xxxx/xxx?payload HTTP/1.1        
      Host: {{Hostname}}                      

  matchers:  
    - type: status  #匹配HTTP状态码    
      status:      
        - 200     #匹配状态码为200，确定网页能够访问
    - type: dsl        
      dsl:          
        - 'duration>=5' # 匹配延时时间
    matchers-condition: and

2. 双重验证

id: base  
info:  
  name: base   
  author: msk  
  description: 描述漏洞基本情况  
  severity: info 漏洞等级    
  tags: detect 标签  
  
http:  
  - raw:      
    - |        
      GET /xxxx/xxx?payload HTTP/1.1        
      Host: {{Hostname}}   
      
    - |
      GET /xxxx/xxx?payload HTTP/1.1        
      Host: {{Hostname}} 

  matchers:  
    - type: status  #匹配HTTP状态码    
      status:      
        - 200     #匹配状态码为200，确定网页能够访问
    - type: dsl        
      dsl:          
        - 'duration_1>=5 & duration_1<=6' # 匹配延时时间
        - 'duration_2>=5 & duration_2<=6'
    matchers-condition: and

报错注入

1. GET型

id: base  
info:  
  name: base   
  author: msk  
  description: 描述漏洞基本情况  
  severity: info 漏洞等级    
  tags: detect 标签  
  
http:  
  - raw:      
    - |        
      GET /xxxx/xxx?payload HTTP/1.1        
      Host: {{Hostname}}   
      
    - |
      GET /xxxx/xxx?payload HTTP/1.1        
      Host: {{Hostname}}

matchers: 
  - type: status  #匹配HTTP状态码    
    status:      
      - 200     #匹配状态码为200，确定网页能够访问
  - type: word    
    part: body    
    words:      
      - "qkpzq1qqkkq"    #报错提示
    condition: and

2. POST型

id: base  
info:  
  name: base   
  author: msk  
  description: 描述漏洞基本情况  
  severity: info  # 漏洞等级    
  tags: detect  # 标签  
  
http:  
  - raw:      
    - |        
      POST /xxxx/xxx HTTP/1.1        
      Host: {{Hostname}}   
      Content-Type: application/x-www-form-urlencoded
      
      username=admin&&password=admin  # 替换为实际 POST 数据

    - |
      POST /xxxx/xxx HTTP/1.1        
      Host: {{Hostname}}
      Content-Type: application/x-www-form-urlencoded
      
      username=admin&&password=admin  # 替换为第二个 POST 数据

matchers:
  - type: status  #匹配HTTP状态码    
    status:      
      - 200     #匹配状态码为200，确定网页能够访问
  - type: word    
    part: body    
    words:      
      - "qkpzq1qqkkq"  # 报错提示
    condition: and