sql-labs（1~10）详细思路

sql-labs（1~10）

参考：
https://space.bilibili.com/29903122/
https://forum.90sec.com/t/topic/1774

sql-labs安装

Github下载地址：https://github.com/Audi-1/sqli-labs

相关组件下载安装

phpstudy

储备知识（information_schema）

参考链接：https://blog.csdn.net/kikajack/article/details/80065753

information_schema数据库和performance_schema一样，都是Mysql自带的信息数据库。performance_schema用于性能分析，而information_schema用于存储数据库元数据，例如：数据库名、表名、列的数据类型、访问权限等。

information_schema库中常用的表

character_sets表：提供mysql可用字符集的信息。（占用空间，查询结果取前10）

mysql> select * from information_schema.character_sets limit 0,10;
+--------------------+----------------------+-----------------------------+--------+
| CHARACTER_SET_NAME | DEFAULT_COLLATE_NAME | DESCRIPTION                 | MAXLEN |
+--------------------+----------------------+-----------------------------+--------+
| big5               | big5_chinese_ci      | Big5 Traditional Chinese    |      2 |
| dec8               | dec8_swedish_ci      | DEC West European           |      1 |
| cp850              | cp850_general_ci     | DOS West European           |      1 |
| hp8                | hp8_english_ci       | HP West European            |      1 |
| koi8r              | koi8r_general_ci     | KOI8-R Relcom Russian       |      1 |
| latin1             | latin1_swedish_ci    | cp1252 West European        |      1 |
| latin2             | latin2_general_ci    | ISO 8859-2 Central European |      1 |
| swe7               | swe7_swedish_ci      | 7bit Swedish                |      1 |
| ascii              | ascii_general_ci     | US ASCII                    |      1 |
| ujis               | ujis_japanese_ci     | EUC-JP Japanese             |      3 |
+--------------------+----------------------+-----------------------------+--------+
10 rows in set (0.09 sec)

schemata表：当前mysql实例中所有数据库信息。

mysql> desc information_schema.schemata;
+----------------------------+------------------+------+-----+---------+-------+
| Field                      | Type             | Null | Key | Default | Extra |
+----------------------------+------------------+------+-----+---------+-------+
| CATALOG_NAME               | varchar(64)      | YES  |     | NULL    |       |
| SCHEMA_NAME                | varchar(64)      | YES  |     | NULL    |       |
| DEFAULT_CHARACTER_SET_NAME | varchar(64)      | NO   |     | NULL    |       |
| DEFAULT_COLLATION_NAME     | varchar(64)      | NO   |     | NULL    |       |
| SQL_PATH                   | binary(0)        | YES  |     | NULL    |       |
| DEFAULT_ENCRYPTION         | enum('NO','YES') | NO   |     | NULL    |       |
+----------------------------+------------------+------+-----+---------+-------+
6 rows in set (0.46 sec)

mysql> select schema_name from information_schema.schemata;
+--------------------+
| SCHEMA_NAME        |
+--------------------+
| mysql              |
| information_schema |
| performance_schema |
| sys                |
| stu111             |
| an                 |
| shop               |
| eg                 |
| secret             |
| test               |
| security           |
| challenges         |
+--------------------+
12 rows in set (0.05 sec)

tables表：存储数据库中的表信息（包括视图）包括表属于哪个数据库，表的类型、存储引擎、创建时间等信息。

mysql> select table_name,table_type,engine,row_format from information_schema.tables where table_schema="security";
+------------+------------+--------+------------+
| TABLE_NAME | TABLE_TYPE | ENGINE | ROW_FORMAT |
+------------+------------+--------+------------+
| emails     | BASE TABLE | InnoDB | Dynamic    |
| referers   | BASE TABLE | InnoDB | Dynamic    |
| uagents    | BASE TABLE | InnoDB