4.联合查询注入
联合注入原理
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912254-678966938.png)
联合查询,两边的字段数要相同,不然会报错
就像这样
select from users where user_id=1 union select * from guestbook
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909297-799577852.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909508-1785490774.png)
上述联合查询语句可以拆分为两个查询语句
select from users where user_id=1
和
select from guestbook
接下来要确定两个查询语句的字段数
select from users where user_id=1
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909311-1460443533.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909338-766091677.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912005-964911112.png)
字段数(注入点)为8
select * from guestbook
的完全语句为
select * from guestbook where comment_id = 1
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909346-453643256.png)
字段数为3
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909991-1425203343.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909373-435161965.png)
利用联合查询创造多个查询点,然后将第二个查询语句的数字替换成为各种函数,一次性进行多个查询
限定语句导致的错误
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095910019-1246998818.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909826-1364682168.png)
当联合查询两个以上语句时,如果将comment_id设定为1的话,那除了第一个语句外的后面的所有语句都将不会回显出来
联合注入攻击
白盒测试流程
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912933-2081093233.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912038-941205727.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912213-1512344922.png)
攻击开始
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912650-1064061362.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912309-1229746794.png)
判断为字符型还是数字型
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909429-1121400960.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909430-1278245065.png)
这里只是将Id更改了,没有其他变化,不像数字型注入漏洞
改为字符型试探
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909446-1222642007.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909456-853373580.png)
当输入值改为1' and '1'='2时,页面直接崩溃,说明这里有一个字符型注入漏洞
判断字段数(注入点)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095911678-1899808505.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909469-1517385245.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095910068-952957430.png)
注入点确定,这里只有两个注入点
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909483-1650743516.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909485-1264622005.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095913115-161625466.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095910159-1579789795.png)
数据库连接账户为localhost
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909536-114756295.png)
连接的数据库名称为dvwa
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909541-913176433.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909847-895628422.png)
版本为5.7.33
查询对方数据库中符号的表示方法
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095910157-677873570.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909566-1121677753.png)
就会生成对应的字符
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909568-1210932648.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909857-702731046.png)
这样可以将数据库吐出来的数据更加美观一些
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909862-606665313.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095913070-1909750331.png)
黑盒测试是不知道数据库内部结构和表名的
但数据库的表的数据都会保存在information_schema这个表中,我们只要将这个一定会存在的表,给他破解掉,就可以获得这个数据库中的全部表名了
黑盒测试流程
获取表名
select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=database() limit 1
将注入点数字替换为这个语句
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909615-1549147693.png)
得到第一个表名
将注入点写入这个语句
select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=database() limit 1,1
得到第二个表名
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909617-1026500451.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909879-314524224.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912743-1027299571.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909646-119930240.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095910258-1437206608.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095909674-1204783385.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095910258-1091076716.png)
根据表名查询字段
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095913009-1350363571.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912507-723174586.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912862-815331433.png)
通过字段查询内容
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095912603-1792451510.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111095911426-333393857.png)