3.3.手工SQL注入
首先输入正确账号,得到正确结果
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924652-287959810.png)
开始试探
试探变量可影响性
确认用户控制的变量是否可以影响数据库
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924593-1282660833.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924552-871722024.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924552-1921478523.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924629-914693414.png)
在非用户名不同的情况下,因为并查询结果导致报错,确认变量可以影响对方数据库
试探注入点个数
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924562-1420331254.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924586-866887130.png)
一个试探成功
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924628-770768447.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924566-960722768.png)
两个注入点试探成功
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924637-1504123605.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924609-217284270.png)
第三个注入点试探失败
确认此处有两个注入点
注入语句
提取两个注入点对应语句
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924605-1853884445.png)
将原有正确账户改错,只显示联合查询的两个注入点语句
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924655-207724044.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924679-69652289.png)
用语句替换注入点数字,进行数据库注入
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924589-284478753.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924656-13048571.png)
当前连接数据库的管理员为localhost
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924587-516388509.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924640-267323235.png)
当前连接的数据库为pikachu
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924601-1131775634.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924676-1704284861.png)
当前数据库版本为5.7.33-0ubuntu0.16.04.1
以上为基础命令注入,接下来可以尝试注入一些完整的语句
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924655-1253841198.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924680-1767014296.png)
要注意,在2这个注入点中,只能放置一个查询字段,即username和password只能选一个
或者利用group_concat()将两个字段拼接到一起,可以被当成一个字段使用
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924609-1284089766.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111094924660-785817434.png)
这里查出三个账号与密码
admine和10adc3949ba59abbe56e057f20f883e
pikachu和670b14728ad9902aecba32e22fa4f6bd
teste和99a18c428cb38d5f260853678922e03