Home
glasses96
Cancel

Blind SQLi With Bit operation & Burp Intruder

Bit operation์„ ์ด์šฉํ•˜์—ฌ ๋ฒ„ํ”„์Šค์œ„ํŠธ์˜ Intruder ๊ธฐ๋Šฅ์œผ๋กœ ๊ฐ„๋‹จํ•˜๊ฒŒ DB๋ฅผ ์ถ”์ถœํ•  ์ˆ˜์žˆ๋Š” ๋ฐฉ๋ฒ•์„ ์•Œ์•„๋ด…์‹œ๋‹ค. Bit operation ํ•ญ์ƒ Binary Search๋ฅผ ์ด์šฉํ•˜์—ฌ Blind SQLi ์Šคํฌ๋ฆฝํŠธ๋ฅผ ๋ฅผ ๋งŒ๋“ค์—ˆ๋Š”๋ฐ ๋“œ๋ฆผํ•ต ๊ฐ•์˜๋ฅผ ํ†ตํ•ด MySQL DB์—์„œ Bit operation์„ ์ด์šฉํ•ด๋„ ๋˜๋Š” ๊ฒƒ์„ ์•Œ๊ฒŒ๋˜์—ˆ์Šต๋‹ˆ๋‹ค ...

Oct 22, 2022 Web, SQLi

XSS Filtering bypass with JSFuck

XSS๋ฅผ ๋ฐœ๊ฒฌํ–ˆ์ง€๋งŒ alert, confirm, prompt๋“ฑ ๋ฌธ์ž์—ด์ด WAF์—์„œ ํ•„ํ„ฐ๋ง ๋˜์—ˆ์„ ๋•Œ JSFuck์„ ์ด์šฉํ•˜์—ฌ ์ด๋ฅผ ์šฐํšŒํ•˜๋Š” ๋ฐฉ๋ฒ•์„ ์•Œ์•„๋ด…์‹œ๋‹ค. What is JSFuck? ์œ„ํ‚ค์— ๋”ฐ๋ฅด๋ฉด JavaScript ๋ฌธ๋ฒ•์—์„œ ์‚ฌ์šฉ๋˜๋Š” ๋ฌธ์ž ์ค‘ ๋‹จ 6๊ฐ€์ง€์ธ [,],(,),!,+ ๋งŒ์œผ๋กœ ๊ตฌํ˜„ํ•  ์ˆ˜ ์žˆ์Œ์— ์ฐฉ์•ˆํ•˜์—ฌ ๊ณ ์•ˆ๋œ ๋‚œํ•ดํ•œ ํ”„๋กœ๊ทธ๋ž˜...

Oct 17, 2022 Web, XSS
Recently Updated