Ghost Bit SQL 注入绕 WAF

1
{
2
     "items": [
3
          {
4
               "name": "Admin Panel",
5
               "description": "System administration interface",
6
               "id": 1,
7
               "category": "System"
8
          },
9
          {
10
               "name": "Flag Manager",
11
               "description": "Feature flag management service",
12
               "id": 3,
13
               "category": "DevOps"
14
          },
15
          {
16
               "name": "User Auth Service",
17
               "description": "Authentication and authorization",
18
               "id": 4,
19
               "category": "Security"
20
          },
21
          {
22
               "name": "DataSync Module",
23
               "description": "Real-time data synchronization",
24
               "id": 5,
25
               "category": "Module"
26
          },
27
          {
28
               "name": "API Gateway",
29
               "description": "Request routing and rate limiting",
30
               "id": 6,
31
               "category": "Infrastructure"
32
          },
33
          {
34
               "name": "Cache Layer",
35
               "description": "Distributed caching service",
36
               "id": 8,
37
               "category": "Infrastructure"
38
          },
39
          {
40
               "name": "AAA Framework",
41
               "description": "Authentication Authorization Accounting",
42
               "id": 9,
43
               "category": "Security"
44
          },
45
          {
46
               "name": "Task Scheduler",
47
               "description": "Cron job management platform",
48
               "id": 10,
49
               "category": "DevOps"
50
          }
51
     ],
52
     "status": "success"
53
}

1
public class QuerySerializer {
2

3
    private static final byte PROTOCOL_VERSION = 0x01;
4
    private static final byte MSG_TYPE_QUERY = 0x02;
5

6
    public static String serializeAndDeserialize(String input) throws IOException {
7
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
8
        DataOutputStream dos = new DataOutputStream(baos);
9

10
        dos.writeByte(PROTOCOL_VERSION);
11
        dos.writeByte(MSG_TYPE_QUERY);
12
        dos.writeInt(input.length());
13
        dos.writeBytes(input);    // 关键漏洞点！
14
        dos.flush();
15

16
        byte[] data = baos.toByteArray();
17
        DataInputStream dis = new DataInputStream(new ByteArrayInputStream(data));
18

19
        dis.readByte();
20
        dis.readByte();
21
        int len = dis.readInt();
22

23
        byte[] queryBytes = new byte[len];
24
        dis.readFully(queryBytes);
25

26
        return new String(queryBytes, StandardCharsets.UTF_8);
27
    }
28
}

1
{
2
  "items": [
3
    {
4
      "name": "Admin Panel",
5
      "description": "System administration interface",
6
      "id": 1,
7
      "category": "System"
8
    },
9
    {
10
      "name": "Test Environment",
11
      "id": 2,
12
      "category": "DevOps"
13
    },
14
    {
15
      "name": "Flag Manager",
16
      "description": "Feature flag management service",
17
      "id": 3,
18
      "category": "DevOps"
19
    },
20
    {
21
      "name": "User Auth Service",
22
      "description": "Authentication and authorization",
23
      "id": 4,
24
      "category": "Security"
25
    },
26
    {
27
      "name": "DataSync Module",
28
      "description": "Real-time data synchronization",
29
      "id": 5,
30
      "category": "Module"
31
    },
32
    {
33
      "name": "API Gateway",
34
      "description": "Request routing and rate limiting",
35
      "id": 6,
36
      "category": "Infrastructure"
37
    },
38
    {
39
      "name": "Log Collector",
40
      "description": "Centralized log aggregation",
41
      "id": 7,
42
      "category": "Monitoring"
43
    },
44
    {
45
      "name": "Cache Layer",
46
      "description": "Distributed caching service",
47
      "id": 8,
48
      "category": "Infrastructure"
49
    },
50
    {
51
      "name": "AAA Framework",
52
      "description": "Authentication Authorization Accounting",
53
      "id": 9,
54
      "category": "Security"
55
    },
56
    {
57
      "name": "Task Scheduler",
58
      "description": "Cron job management platform",
59
      "id": 10,
60
      "category": "DevOps"
61
    }
62
  ],
63
  "status": "success"
64
}

1
用户输入 (全非ASCII Unicode)
2
    │
3
    ▼
4
┌─────────────────────────────┐
5
│  WAF 检测                    │
6
│  所有字符 ≥ 0x80             │
7
│  → isAllNonAscii = true     │
8
│  → 直接放行，不做黑名单检测   │
9
└─────────────────────────────┘
10
    │
11
    ▼
12
┌─────────────────────────────────────┐
13
│  QuerySerializer (二进制协议管道)     │
14
│  DataOutputStream.writeBytes()      │
15
│  (byte)s.charAt(i)                  │
16
│  截断char高字节                      │
17
│  U+01XX → 0xXX                      │
18
│  非ASCII → ASCII                     │
19
└─────────────────────────────────────┘
20
    │
21
    ▼
22
┌─────────────────────────────┐
23
│  SQL LIKE 拼接               │
24
│  还原后的ASCII字符构成        │
25
│  有效的SQL注入语句            │
26
└─────────────────────────────┘